Add optional claim verification

Author: mevdschee

README.md

@@ -165,6 +165,9 @@ You can tune the middleware behavior using middleware specific configuration par
 - "jwtAuth.leeway": The acceptable number of seconds of clock skew ("5")
 - "jwtAuth.ttl": The number of seconds the token is valid ("30")
 - "jwtAuth.secret": The shared secret used to sign the JWT token with ("")
+- "jwtAuth.algorithms": The algorithms that are allowed, empty means 'all' ("")
+- "jwtAuth.audiences": The audiences that are allowed, empty means 'all' ("")
+- "jwtAuth.issuers": The issuers that are allowed, empty means 'all' ("")
 - "basicAuth.mode": Set to "optional" if you want to allow anonymous access ("required")
 - "basicAuth.realm": Text to prompt when showing login ("Username and password required")
 - "basicAuth.passwordFile": The file to read for username/password combinations (".htpasswd")

src/Tqdev/PhpCrudApi/Middleware/JwtAuthMiddleware.php

@@ -9,7 +9,7 @@
 
 class JwtAuthMiddleware extends Middleware
 {
-    private function getVerifiedClaims(String $token, int $time, int $leeway, int $ttl, String $secret): array
+    private function getVerifiedClaims(String $token, int $time, int $leeway, int $ttl, String $secret, array $requirements): array
     {
         $algorithms = array('HS256' => 'sha256', 'HS384' => 'sha384', 'HS512' => 'sha512');
         $token = explode('.', $token);
@@ -36,6 +36,13 @@ private function getVerifiedClaims(String $token, int $time, int $leeway, int $t
         if (!$claims) {
             return array();
         }
+        foreach ($requirements as $field => $values) {
+            if (!empty($values)) {
+                if (!isset($claims[$field]) || !in_array($claims[$field], $values)) {
+                    return array();
+                }
+            }
+        }
         if (isset($claims['nbf']) && $time + $leeway < $claims['nbf']) {
             return array();
         }
@@ -53,16 +60,26 @@ private function getVerifiedClaims(String $token, int $time, int $leeway, int $t
         return $claims;
     }
 
+    private function getArrayProperty(String $property, String $default): array
+    {
+        return array_filter(array_map('trim', explode(',', $this->getProperty($property, $default))));
+    }
+
     private function getClaims(String $token): array
     {
         $time = (int) $this->getProperty('time', time());
         $leeway = (int) $this->getProperty('leeway', '5');
         $ttl = (int) $this->getProperty('ttl', '30');
         $secret = $this->getProperty('secret', '');
+        $requirements = array(
+            'alg' => $this->getArrayProperty('algorithms', ''),
+            'aud' => $this->getArrayProperty('audiences', ''),
+            'iss' => $this->getArrayProperty('issuers', ''),
+        );
         if (!$secret) {
             return array();
         }
-        return $this->getVerifiedClaims($token, $time, $leeway, $ttl, $secret);
+        return $this->getVerifiedClaims($token, $time, $leeway, $ttl, $secret, $requirements);
     }
 
     private function getAuthorizationToken(Request $request): String