Adding extra slashes after domain name in url allows you to bypass JWT Authentication about slim-jwt-auth HOT 6 CLOSED

Ok I misunderstood. It seems that even though /foo and ///foo are different URL's for browser, on server side it seems to map to same url. A bit surprising behaviour but quickly checking RFC 3986 this seems to be correct behaviour.

Will commit a fix soon.

from slim-jwt-auth.

Yep, this is what I did: $uri = preg_replace("#/+#", "/", $uri);.

from slim-jwt-auth.

Add a logger or error handler to debug why the the authentication fails.

https://github.com/tuupola/slim-jwt-auth#logger
https://github.com/tuupola/slim-jwt-auth#error

from slim-jwt-auth.

HTTP 401 Unauthorized is expected because I made the request without the token in the Authorization header. (I forgot to mention it in the first comment.)

from slim-jwt-auth.

While waiting for your commit, I was able to temporarily fix the issue by replacing:
$uri = str_replace("//", "/", $uri); with $uri = preg_replace("/(\/)+/", "/", $uri); in RequestPathRule.php line 52.

from slim-jwt-auth.

Fixed in 2.3.2 and 1.0.4.

from slim-jwt-auth.