Almost four months after the first stable release of JWT-Framework, a new version is about to ship. It is a minor release, but it brings a number of changes. Here are the main ones.
The online documentation will of course be updated when it is released.
JWS and JWE loaders
Support for JWSLoader and JWELoader has been improved, in particular from the configuration of your Symfony application.
These components read a token and verify or decrypt it in a single call. Headers are checked too, whenever a HeaderCheckerManager is provided.
Nested tokens
A dedicated class now makes reading and creating nested tokens simpler.
As a reminder, such a token is first signed (JWS) then encrypted (JWE). Using them guarantees not only the confidentiality of the data, but also its integrity and the identity of its issuer.
final, or not final
Early in the project, most classes were declared final. The idea was to prevent other classes from inheriting them, and to force composition instead.
That approach causes no trouble as long as every public method is covered by an interface. For a fair number of them, that was not the case.
The keyword has therefore been removed.
JWK from a shared key
Creating a JWK from a shared key is a trivial operation, but a new method and a console command have been added for it.
Tagging services
It is now possible to attach one or more tags to every service created by the Symfony bundle.
Bug fixes
Many bugs have been fixed. The whole project now passes level 6 of the standard PHPStan rules. Twenty-six level 7 issues remain, the maximum level at the time of writing, and will be handled in a later release.
None of them is critical.