Claim and header checker managers silently keep only the last checker of a claim or header parameter

Open
  • Is something wrong?
#756 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
42/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
php
Domain
backend, security

Research direction

Read the ClaimCheckerManager and HeaderCheckerManager constructors, then trace the library and bundle factory paths and the checker configuration aliases described in the issue. Compare the behavior across the 4.3.x and 5.0.x branches; done means duplicate checker names are reported or rejected as specified for each branch, and the documented one-checker-per-name rule covers bundle configuration.

Written by the indexing model from the issue text.

Description

bug
Version(s) affected

All released versions since 0.2.0 (3.4.x, 4.0.x, 4.1.x, 4.2.x), and the 4.3.x and 5.0.x branches.

Description

ClaimCheckerManager and HeaderCheckerManager index their checkers by supportedClaim() / supportedHeader(). When two checkers of the list cover the same name, the second one replaces the first, which never runs. Nothing is thrown or logged.

$manager = new ClaimCheckerManager([
    new ExpirationTimeChecker($clock),
    new CallableChecker('exp', $maxLifetime), // at most one hour left to live
]);
$manager->getCheckers(); // ['exp' => CallableChecker]

With this list an expired token passes check(). With the two checkers in the other order, a token valid for ten years passes. No order enforces both rules. Two AudienceCheckers behave the same way. In a header checker manager, the replacement can also drop the protected-only requirement of that parameter.

Every construction path ends in these constructors: the library and bundle factories, jose.checkers.claims / jose.checkers.headers, and the header_checkers of the loaders. In the bundle the lists hold aliases, which do not show the name each checker covers: claims: ['exp', 'iat', 'nbf', 'max_lifetime'], where max_lifetime is a CallableChecker('exp', ...) service, gives a manager without ExpirationTimeChecker. On 4.3.x, the typ: option appends a generated TypeChecker, which replaces any typ checker listed in headers: of the same manager.

Before 0.2.0 the managers refused a second checker for a name (The claim checker "%s" is already supported.). That guard was removed in 387aac8b (November 2017), together with the alias guard of the factories.

Only applications that give one manager two checkers for the same claim or header parameter are concerned. For them, the rule of the replaced checker is not enforced, and nothing tells them.

How to reproduce
$manager = new ClaimCheckerManager([
    new AudienceChecker('api'),
    new AudienceChecker('tenant-42'),
]);
$manager->check(['aud' => ['other', 'tenant-42']]); // passes: the "api" checker never runs
Possible Solution
  • 4.3.0: trigger a deprecation in both constructors when a name is already covered by a different checker instance (the same instance listed twice stays silent), and keep the current behaviour.
  • 5.0.0: throw an InvalidArgumentException.
  • Document that a manager takes one checker per claim or header parameter, and that several rules on one claim belong in one checker.
Additional Context

Found by the Anthropic OSS Scanner (ANT-2026-YWJFJRRB).

Dominant language
PHP
Stars
954
Forks
119
Avg merge
48m
Merged PRs (30d)
17

Getting set up

This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from web-token/jwt-framework

All issues in web-token/jwt-framework

Similar issues

More PHP issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.