Fixed possible issue with JWT decoding

this is url-encoded, these characters should be replaced before base64_decode()ing. Not sure how this didn't get noticed before now.
This commit is contained in:
Dylan K. Taylor 2017-09-22 19:52:08 +01:00
parent c8fd0eaf8b
commit 5190d9c1e2

View File

@ -541,6 +541,6 @@ class Utils{
public static function decodeJWT(string $token) : array{
list($headB64, $payloadB64, $sigB64) = explode(".", $token);
return json_decode(base64_decode($payloadB64), true);
return json_decode(base64_decode(strtr($payloadB64, '-_', '+/'), true), true);
}
}