Add test case

Author: cdoco

README.md

@@ -1,6 +1,6 @@
 <div align="center">
     <p><img src="https://jwt.io/img/logo-asset.svg" /></p>
-    <p>A PHP extension for JSON Web Token (JWT)</p>
+    <p>A PHP extension for <a target="_blank" href="https://tools.ietf.org/html/rfc7519">RFC 7519 OAuth JSON Web Token (JWT)</a></p>
     <a target="_blank" href="https://travis-ci.org/cdoco/php-jwt" title="Build Status"><img src="https://travis-ci.org/cdoco/php-jwt.svg"></a>
     <img src="https://img.shields.io/badge/branch-master-brightgreen.svg?style=flat-square">
 </div>
@@ -252,20 +252,24 @@ try {
 
 ### Audience Claim
 
+> The `aud` (audience) claim identifies the recipients that the JWT is intended for. Each principal intended to process the JWT MUST identify itself with a value in the audience claim. If the principal processing the claim does not identify itself with a value in the `aud` claim when this claim is present, then the JWT MUST be rejected. In the general case, the `aud` value is an array of case-sensitive strings, each containing a **StringOrURI** value. In the special case when the JWT has one audience, the `aud` value MAY be a single case-sensitive string containing a **StringOrURI** value. The interpretation of audience values is generally application specific. Use of this claim is OPTIONAL.
+
 ```php
 $payload = ['data' => 'data', 'aud' => 'Young Man'];
 
 $token = jwt_encode($payload, $hmackey, 'HS256');
 
 try {
-    $decoded_token = jwt_decode($token, $hmackey, ['iss' => 'Young Man', 'algorithm' => 'HS256']);
+    $decoded_token = jwt_decode($token, $hmackey, ['aud' => 'Young Man', 'algorithm' => 'HS256']);
 } catch (Exception $e) {
      // Handle invalid token
 }
 ```
 
 ### JWT ID Claim
 
+> The `jti` (JWT ID) claim provides a unique identifier for the JWT. The identifier value MUST be assigned in a manner that ensures that there is a negligible probability that the same value will be accidentally assigned to a different data object; if the application uses multiple issuers, collisions MUST be prevented among values produced by different issuers as well. The `jti` claim can be used to prevent the JWT from being replayed. The `jti` value is a **case-sensitive string**. Use of this claim is OPTIONAL.
+
 ```php
 $payload = ['data' => 'data', 'jti' => md5('id')];
 
@@ -280,6 +284,8 @@ try {
 
 ### Issued At Claim
 
+> The `iat` (issued at) claim identifies the time at which the JWT was issued. This claim can be used to determine the age of the JWT. Its value MUST be a number containing a **NumericDate** value. Use of this claim is OPTIONAL.
+
 ```php
 $payload = ['data' => 'data', 'iat' => time()];
 
@@ -294,6 +300,8 @@ try {
 
 ### Subject Claim
 
+> The `sub` (subject) claim identifies the principal that is the subject of the JWT. The Claims in a JWT are normally statements about the subject. The subject value MUST either be scoped to be locally unique in the context of the issuer or be globally unique. The processing of this claim is generally application specific. The sub value is a case-sensitive string containing a **StringOrURI** value. Use of this claim is OPTIONAL.
+
 ```php
 $payload = ['data' => 'data', 'sub' => 'Subject'];
 
@@ -328,6 +336,13 @@ HMAC|HS256|HS384|HS512
 RSA|RS256|RS384|RS512
 ECDSA|ES256|ES384|ES512
 
+## Inspired By
+
+- <https://github.com/benmcollins/libjwt>
+- <https://github.com/firebase/php-jwt>
+- <https://github.com/kohkimakimoto/php-jwt>
+- <https://github.com/jwt/ruby-jwt>
+
 ## License
 
 PHP License. See the [LICENSE](LICENSE) file.

jwt.c

@@ -348,16 +348,16 @@ int jwt_parse_options(zval *options)
 
 PHP_FUNCTION(jwt_encode)
 {
-    zval *claims = NULL, header;
+    zval *payload = NULL, header;
     zend_string *key = NULL;
-    smart_str json_header = {0}, json_claims = {0}, segments = {0};
+    smart_str json_header = {0}, json_payload = {0}, segments = {0};
 
     char *sig = NULL, *alg = "HS256";
     unsigned int sig_len;
     size_t alg_len;
     jwt_t *jwt = NULL;
 
-    if (zend_parse_parameters(ZEND_NUM_ARGS(), "aS|s", &claims, &key, &alg, &alg_len) == FAILURE) {
+    if (zend_parse_parameters(ZEND_NUM_ARGS(), "aS|s", &payload, &key, &alg, &alg_len) == FAILURE) {
         return;
     }
 
@@ -373,9 +373,9 @@ PHP_FUNCTION(jwt_encode)
     }
 
     /* set expiration and not before */
-    JWT_G(expiration) = jwt_hash_str_find_long(claims, "exp");
-    JWT_G(not_before) = jwt_hash_str_find_long(claims, "nbf");
-    JWT_G(iat) = jwt_hash_str_find_long(claims, "iat");
+    JWT_G(expiration) = jwt_hash_str_find_long(payload, "exp");
+    JWT_G(not_before) = jwt_hash_str_find_long(payload, "nbf");
+    JWT_G(iat) = jwt_hash_str_find_long(payload, "iat");
 
     /* init */
     array_init(&header);
@@ -386,17 +386,17 @@ PHP_FUNCTION(jwt_encode)
 
     /* json encode */
     php_json_encode(&json_header, &header, 0);
-    php_json_encode(&json_claims, claims, 0);
+    php_json_encode(&json_payload, payload, 0);
 
     zval_ptr_dtor(&header);
 
     /* base64 encode */
     smart_str_appends(&segments, jwt_b64_url_encode(json_header.s));
     smart_str_appends(&segments, ".");
-    smart_str_appends(&segments, jwt_b64_url_encode(json_claims.s));
+    smart_str_appends(&segments, jwt_b64_url_encode(json_payload.s));
 
     smart_str_free(&json_header);
-    smart_str_free(&json_claims);
+    smart_str_free(&json_payload);
 
     /* sign */
     if (jwt->alg == JWT_ALG_NONE) {

tests/006.phpt

@@ -0,0 +1,28 @@
+--TEST--
+Check for jwt exp claim name (Expired token)
+--SKIPIF--
+<?php if (!extension_loaded("jwt")) print "skip"; ?>
+--FILE--
+<?php 
+$hmackey = "example-hmac-key";
+$payload = ['data' => 'data', 'exp' => time() - 10];
+$token = jwt_encode($payload, $hmackey, 'HS256');
+
+try {
+    $decoded_token = jwt_decode($token, $hmackey, ['algorithm' => 'HS256']);
+} catch (Exception $e) {
+    // Expired token
+    echo $e->getMessage() . "\n";
+}
+
+try {
+    $decoded_token = jwt_decode($token, $hmackey, ['leeway' => 30, 'algorithm' => 'HS256']);
+    echo "Success\n";
+} catch (Exception $e) {
+    // Expired token
+    echo $e->getMessage() . "\n";
+}
+?>
+--EXPECT--
+Expired token
+Success

tests/007.phpt

@@ -0,0 +1,27 @@
+--TEST--
+Check for jwt nbf claim name
+--SKIPIF--
+<?php if (!extension_loaded("jwt")) print "skip"; ?>
+--FILE--
+<?php
+$hmackey = "example-hmac-key";
+$payload = ['data' => 'data', 'nbf' => time() + 10];
+$token = jwt_encode($payload, $hmackey, 'HS256');
+
+try {
+    $decoded_token = jwt_decode($token, $hmackey, ['algorithm' => 'HS256']);
+} catch (Exception $e) {
+    // Expired token
+    echo "FAIL\n";
+}
+
+try {
+    $decoded_token = jwt_decode($token, $hmackey, ['leeway' => 30, 'algorithm' => 'HS256']);
+    echo "SUCCESS\n";
+} catch (Exception $e) {
+    // Expired token
+}
+?>
+--EXPECT--
+FAIL
+SUCCESS

tests/008.phpt

@@ -0,0 +1,20 @@
+--TEST--
+Check for jwt iat claim name
+--SKIPIF--
+<?php if (!extension_loaded("jwt")) print "skip"; ?>
+--FILE--
+<?php
+$hmackey = "example-hmac-key";
+$payload = ['data' => 'data', 'iat' => time()];
+$token = jwt_encode($payload, $hmackey, 'HS256');
+
+try {
+    $decoded_token = jwt_decode($token, $hmackey, ['algorithm' => 'HS256']);
+    echo "SUCCESS\n";
+} catch (Exception $e) {
+     // Handle invalid token
+}
+?>
+--EXPECT--
+SUCCESS
+

tests/009.phpt

@@ -0,0 +1,28 @@
+--TEST--
+Check for jwt iss claim name
+--SKIPIF--
+<?php if (!extension_loaded("jwt")) print "skip"; ?>
+--FILE--
+<?php
+$hmackey = "example-hmac-key";
+$payload = ['data' => 'data', 'iss' => 'http://example.org'];
+
+$token = jwt_encode($payload, $hmackey, 'HS256');
+
+try {
+    $decoded_token = jwt_decode($token, $hmackey, ['iss' => 'http://example.org', 'algorithm' => 'HS256']);
+    echo "SUCCESS\n";
+} catch (Exception $e) {
+     // Handle invalid token
+}
+
+try {
+    $decoded_token = jwt_decode($token, $hmackey, ['iss' => 'test', 'algorithm' => 'HS256']);
+} catch (Exception $e) {
+     // Handle invalid token
+     echo "FAIL\n";
+}
+?>
+--EXPECT--
+SUCCESS
+FAIL

tests/010.phpt

@@ -0,0 +1,20 @@
+--TEST--
+Check for jwt claim name
+--SKIPIF--
+<?php if (!extension_loaded("jwt")) print "skip"; ?>
+--FILE--
+<?php
+$hmackey = "example-hmac-key";
+$payload = ['data' => 'data', 'sub' => '1234567890'];
+
+$token = jwt_encode($payload, $hmackey);
+
+try {
+    $decoded_token = jwt_decode($token, $hmackey, ['iss' => 'http://example.org']);
+    echo "SUCCESS\n";
+} catch (Exception $e) {
+    // Expired token
+}
+?>
+--EXPECT--
+SUCCESS