Latency on PHP Docker image + JWT Symfony validation issue about lexik-jose-bridge

[Spomky]

Hi,

I you use RSA-based signatures (RSxxx or PSxxx), please make sure either GMP or BCMATH extension is installed.

[smehdux]

Hi,

I you use RSA-based signatures (RSxxx or PSxxx), please make sure either GMP or BCMATH extension is installed.

Hi,

OK I'll double check it, in the phpinfo() dump I figured out this line:

GNU GMP support	Stanislav Malyshev

What about the fake JWKS (touched) ? why the bridge validate the JWT whatever the value of the key in JWKS ? maybe it ignores this stage if GMP or BCMATH extension is not installed...

[smehdux]

Hi,

I checked also Bitnami/Symfony:6.3 docker image, I got the following with phpinfo() dump.

BCMath support	enabled

GNU GMP support	Stanislav Malyshev

gmp support	enabled
GMP version	6.2.1

[smehdux]

I solved the problem, no latency after installing BCMATH and GMP extensions in my PHP:8.2-FPM image :)

But I'm still wondering why fake JWKS pass instead of returning 401 ! any idea @Spomky ?

which attribute of JWKS is used to verify the JWT signature, "x5c" or "n" ? when I modify "n" the validation doesn't work but it works for any "x5c" fake value. I think the library ignore "x5c" when "n" is provided. do you confirm that ?

My POC is based on this example => https://curity.io/resources/learn/symfony-api/#secure-endpoints-with-jwts