Google OpenIDConnect Exception for ISS verification

[jumbojett]

Google OpenIDConnect Exception for ISS verification

[jumbojett]

@screambeard thank you so much for raising this. Feel free to submit a PR. Both seem logical @rasodu @jricher @screambeard which option would you vote?

[screambeard]

my apologies, it's been a while. however, i've been thinking about this and would suggest the following method:

• add a function to add extra provider urls. similar to the addScope function. this extra provider urls will only be used in the verifyJWTclaims function

• in the verifyJWTclaims function check if the $claims->iss with is in the array which consist of: the standard providerUrl and the extraProviderUrls.

My reasoning is the following:

• the application should work the same for all other providers
• the user using the package should be aware of adding an extra providerUrl and the risk

What do you think @rasodu @jricher @jumbojett ?

If you agree I will make a pull request this week

[svrooij]

How about just creating an array of expected issuers, check with that and throw an error is the issuer is not in the array? That is the recommended way to validate JWT tokens anyway.