{"action":"created","issue":{"url":"https://api.github.com/repos/lcobucci/jwt/issues/42","labels_url":"https://api.github.com/repos/lcobucci/jwt/issues/42/labels{/name}","comments_url":"https://api.github.com/repos/lcobucci/jwt/issues/42/comments","events_url":"https://api.github.com/repos/lcobucci/jwt/issues/42/events","html_url":"https://github.com/lcobucci/jwt/issues/42","id":108024010,"number":42,"title":"Token not validating","user":{"login":"robksawyer","id":179419,"avatar_url":"https://avatars.githubusercontent.com/u/179419?v=3","gravatar_id":"","url":"https://api.github.com/users/robksawyer","html_url":"https://github.com/robksawyer","followers_url":"https://api.github.com/users/robksawyer/followers","following_url":"https://api.github.com/users/robksawyer/following{/other_user}","gists_url":"https://api.github.com/users/robksawyer/gists{/gist_id}","starred_url":"https://api.github.com/users/robksawyer/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/robksawyer/subscriptions","organizations_url":"https://api.github.com/users/robksawyer/orgs","repos_url":"https://api.github.com/users/robksawyer/repos","events_url":"https://api.github.com/users/robksawyer/events{/privacy}","received_events_url":"https://api.github.com/users/robksawyer/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/lcobucci/jwt/labels/question","name":"question","color":"cc317c"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-09-23T22:56:55Z","updated_at":"2015-09-25T15:28:19Z","closed_at":null,"body":"See any reason why the following wouldn't validate? Note: I've included the required files, as well. \r\n\r\n```\r\n//Setting the token\r\n//Find the server details\r\n$tokenId    = base64_encode(mcrypt_create_iv(32));\r\n$pieces \t\t= parse_url(Router::url('/', true));\r\n$serverName = $pieces['host']; // Retrieve the server name from config file\r\n\r\n$signer = new Sha256();\r\n$token = (new Builder())->setIssuer($serverName) // Configures the issuer (iss claim)\r\n\t\t\t\t\t\t\t\t\t\t->setAudience($serverName) // Configures the audience (aud claim)\r\n\t\t\t\t\t\t\t\t\t\t->setId($tokenId, true) // Configures the id (jti claim), replicating as a header item\r\n\t\t\t\t\t\t\t\t\t\t->setIssuedAt(time()) // Configures the time that the token was issue (iat claim)\r\n\t\t\t\t\t\t\t\t\t\t->setNotBefore(time() + 60) // Configures the time that the token can be used (nbf claim)\r\n\t\t\t\t\t\t\t\t\t\t->setExpiration(time() + 3600) // (1 hour) Configures the expiration time of the token (exp claim)\r\n\t\t\t\t\t\t\t\t\t\t//->set('sub', $user['User']['email']) // Configures a new claim, called \"id\"\r\n\t\t\t\t\t\t\t\t\t\t->set('id', $user['User']['id']) // Configures a new claim, called \"id\"\r\n\t\t\t\t\t\t\t\t\t\t->set('username', $user['User']['username']) // Configures a new claim, called \"username\"\r\n\t\t\t\t\t\t\t\t\t\t->set('role', $user['User']['role']) // Configures a new claim, called \"role\"\r\n\t\t\t\t\t\t\t\t\t\t->set('banned', $user['User']['banned']) // Configures a new claim, called \"role\"\r\n\t\t\t\t\t\t\t\t\t\t->set('supporter', $user['User']['supporter']) // Configures a new claim, called \"role\"\r\n\t\t\t\t\t\t\t\t\t\t->set('private', $user['User']['private']) // Configures a new claim, called \"private\"\r\n\t\t\t\t\t\t\t\t\t\t//->sign($signer, strval(Configure::read('Security.cipherSeed'))) // creates a signature using \"cipherSeed\" as key\r\n\t\t\t\t\t\t\t\t\t\t->getToken(); // Retrieves the generated token\r\n```\r\n\r\n```\r\n//Validating the token\r\n$decoded = (new Parser())->parse((string) $token); // Parses from a string\r\n$decoded->getHeaders(); // Retrieves the token header\r\n$decoded->getClaims(); // Retrieves the token claims\r\n\r\n//Check to make sure the token exists\r\nif(empty($decoded)){\r\n\t//return json_decode(json_encode(\"Unable to parse token.\"), true);\r\n\tCakeLog::error('JwtTokenAuthenticate:_findUser: Unable to parse token.');\r\n\treturn false;\r\n}\r\n\r\n$uid = (string) $decoded->getClaim('id');\r\nif( !$uid ){\r\n\tCakeLog::error('JwtTokenAuthenticate:_findUser: Unable to find valid id.');\r\n\treturn false;\r\n}\r\n\r\n$pieces \t\t= parse_url(Router::url('/', true));\r\n$serverName = $pieces['host']; // Retrieve the server name from config file\r\n\r\n$data = new ValidationData(); // It will use the current time to validate (iat, nbf and exp)\r\nCakeLog::debug('JwtTokenAuthenticate -> Validating token...');\r\n$data->setIssuer($serverName);\r\n$data->setAudience($serverName);\r\n$data->setId($uid);\r\n//$data->setSigner(strval(Configure::read('Security.cipherSeed')));\r\n\r\n$data->setCurrentTime(time()); // changing the validation time\r\n$validated = $decoded->validate($data);\r\nCakeLog::debug('Validated -> ' . $validated);\r\nif ( $validated ) {\r\n\tCakeLog::debug('Token validated!');\r\n\t//Build a user from the token\r\n\treturn true;\r\n} else {\r\n\tCakeLog::error('Token invalid!');\r\n\treturn false;\r\n}\r\n```\r\n"},"comment":{"url":"https://api.github.com/repos/lcobucci/jwt/issues/comments/143252285","html_url":"https://github.com/lcobucci/jwt/issues/42#issuecomment-143252285","issue_url":"https://api.github.com/repos/lcobucci/jwt/issues/42","id":143252285,"user":{"login":"lcobucci","id":201963,"avatar_url":"https://avatars.githubusercontent.com/u/201963?v=3","gravatar_id":"","url":"https://api.github.com/users/lcobucci","html_url":"https://github.com/lcobucci","followers_url":"https://api.github.com/users/lcobucci/followers","following_url":"https://api.github.com/users/lcobucci/following{/other_user}","gists_url":"https://api.github.com/users/lcobucci/gists{/gist_id}","starred_url":"https://api.github.com/users/lcobucci/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lcobucci/subscriptions","organizations_url":"https://api.github.com/users/lcobucci/orgs","repos_url":"https://api.github.com/users/lcobucci/repos","events_url":"https://api.github.com/users/lcobucci/events{/privacy}","received_events_url":"https://api.github.com/users/lcobucci/received_events","type":"User","site_admin":false},"created_at":"2015-09-25T15:28:19Z","updated_at":"2015-09-25T15:28:19Z","body":"I use the **jti** claim to insert tokens on a blacklist, that helps to make it unavailable despite the other claims.\r\n\r\nThe **aud** claim is a little tricky to use with mobile app, an option is to send a custom HTTP header. I recommend you to think a bit more if you really need it.\r\n\r\nYou're right about **nbf**, if you set it to ```time() + 60``` it will only be available after 60 seconds from the time it was issued.\r\n\r\nI hope you manage to solve things out!"}}