@@ -115,8 +115,8 @@ private function tryBasic(ServerRequestInterface $request, RequestHandlerInterfa
115115 {
116116 $ header = $ request ->getHeaderLine ('Authorization ' );
117117 if (strpos ($ header , 'Basic ' ) === 0 ) {
118- $ decoded = base64_decode (substr ($ header , 6 ));
119- if ($ decoded && strpos ($ decoded , ': ' ) !== false ) {
118+ $ decoded = base64_decode (substr ($ header , 6 ), true );
119+ if ($ decoded !== false && strpos ($ decoded , ': ' ) !== false ) {
120120 [$ username , $ password ] = explode (': ' , $ decoded , 2 );
121121 if (isset ($ this ->config ['basicAuthCallback ' ]) && is_callable ($ this ->config ['basicAuthCallback ' ])) {
122122 $ result = call_user_func ($ this ->config ['basicAuthCallback ' ], $ username , $ password );
@@ -202,11 +202,21 @@ private function validateToken(string $token): bool
202202 try {
203203 // Simple validation - in production, use a proper JWT library
204204 $ parts = explode ('. ' , $ token );
205- if (count ($ parts ) !== 3 ) {
205+ if (count ($ parts ) !== 3 || empty ( $ parts [ 1 ]) ) {
206206 return false ;
207207 }
208208
209- $ payload = json_decode (base64_decode ($ parts [1 ]), true );
209+ $ decoded = base64_decode ($ parts [1 ], true );
210+ if ($ decoded === false ) {
211+ error_log ('JWT token base64 decode failed ' );
212+ return false ;
213+ }
214+
215+ $ payload = json_decode ($ decoded , true );
216+ if ($ payload === null && json_last_error () !== JSON_ERROR_NONE ) {
217+ error_log ('JWT token JSON decode failed: ' . json_last_error_msg ());
218+ return false ;
219+ }
210220
211221 if (!is_array ($ payload )) {
212222 return false ;
@@ -219,10 +229,16 @@ private function validateToken(string $token): bool
219229
220230 // Validate signature (simplified)
221231 $ expectedSignature = hash_hmac ('sha256 ' , $ parts [0 ] . '. ' . $ parts [1 ], $ this ->config ['secret ' ], true );
222- $ actualSignature = base64_decode (strtr ($ parts [2 ], '-_ ' , '+/ ' ));
232+ $ actualSignature = base64_decode (strtr ($ parts [2 ], '-_ ' , '+/ ' ), true );
233+
234+ if ($ actualSignature === false ) {
235+ error_log ('JWT signature base64 decode failed ' );
236+ return false ;
237+ }
223238
224239 return hash_equals ($ expectedSignature , $ actualSignature );
225240 } catch (\Exception $ e ) {
241+ error_log ('JWT validation error: ' . $ e ->getMessage ());
226242 return false ;
227243 }
228244 }
@@ -231,9 +247,25 @@ private function decodeToken(string $token): ?array
231247 {
232248 try {
233249 $ parts = explode ('. ' , $ token );
234- $ decoded = json_decode (base64_decode ($ parts [1 ]), true );
235- return is_array ($ decoded ) ? $ decoded : null ;
250+ if (count ($ parts ) !== 3 || empty ($ parts [1 ])) {
251+ return null ;
252+ }
253+
254+ $ decoded = base64_decode ($ parts [1 ], true );
255+ if ($ decoded === false ) {
256+ error_log ('Token base64 decode failed in decodeToken ' );
257+ return null ;
258+ }
259+
260+ $ payload = json_decode ($ decoded , true );
261+ if ($ payload === null && json_last_error () !== JSON_ERROR_NONE ) {
262+ error_log ('Token JSON decode failed in decodeToken: ' . json_last_error_msg ());
263+ return null ;
264+ }
265+
266+ return is_array ($ payload ) ? $ payload : null ;
236267 } catch (\Exception $ e ) {
268+ error_log ('Token decode error: ' . $ e ->getMessage ());
237269 return null ;
238270 }
239271 }
0 commit comments