Releases: googleapis/google-auth-library-php
Releases · googleapis/google-auth-library-php
v1.25.0
v1.24.0
v1.23.1
v1.23.0
v1.22.0
v1.21.1
v1.21.0
Features
- Support for Firebase v6.0 (#391)
IMPORTANT This release will break backwards compatibility in some cases. If you are using OAuth2::verifyIdToken and passing multiple algorithms as the second argument, this will now throw an exception:
// No problem here, only 1 algorithm is being used
$oauth->verifyIdToken($publicKeys, ['RS256']);
// This was accepted before, but it will now throw an InvalidArgumentException
$oauth->verifyIdToken($publicKeys, ['RS256', 'HS256']);This is because we are closing a security vulnerability (see CVE-2021-46743 and GHSA-8xf4-w7qw-pjjw), and there is no way to close it without throwing an exception in this case. The recommended way to do this is now to pass an array of Firebase\JWT\Key as $publicKeys:
// create an array of Firebase\JWT\Key. For example:
use Firebase\JWT\Key;
$keys = [
new Key($publicKeys[0], 'RS256'),
new Key($publicKeys[1], 'HS256'),
];
$oauth->verifyIdToken($keys);