src/SimpleJWT/JWT.php
/**
     * Deserialises a JWT without checking its validity.
     *
     * Generally, you should use the {@link decode()} function to decode and
     * verify a JWT.  However, in certain circumstances you do not wish to
     * validate JWT, such as obtaining untrusted &quot;hints&quot; from the
     * claims may be a JWT.  This function provides such a deserialisation
     * mechanism
     * 
     * Note that if the JWT contains multiple signatures, an InvalidTokenException
     * will be thrown.
     *
     * @param string $token the serialised JWT
     * @param string $format the JWT serialisation format
     * @return array an array containing `claims` (deserialised claims) and
     * `signatures`, an array of arrays each containing `headers` (the
     * deserialised header), `signing_input` (i.e. the first two
     * parts of the serialised JWT) and `signature` (the signature)
     * @throws InvalidTokenException if the token is invalid for any reason
     */
Deserialises a JWT without checking its validity.
Generally, you should use the  decode() function to decode and
verify a JWT.  However, in certain circumstances you do not wish to
validate JWT, such as obtaining untrusted "hints" from the
claims may be a JWT.  This function provides such a deserialisation
mechanism

Note that if the JWT contains multiple signatures, an InvalidTokenException
will be thrown.


Deserialises a JWT without checking its validity . Generally you should use the decode () function to decode and verify a JWT . However in certain circumstances you do not wish to validate JWT such as obtaining untrusted " hints " from the claims may be a JWT . This function provides such a deserialisation mechanism Note that if the JWT contains multiple signatures an InvalidTokenException will be thrown .
public static function deserialise($token) {
        $detect_result = Helper::detect($token);
        if ($detect_result == null)
            throw new \InvalidArgumentException('Unrecognised token format');
        $format = $detect_result['format'];
        $result = [];
        $signatures = [];
        switch ($format) {
            case self::COMPACT_FORMAT:
                $parts = explode('.', $token, 3);
                if (count($parts) != 3) throw new InvalidTokenException('Cannot decode compact serialisation', InvalidTokenException::TOKEN_PARSE_ERROR);
                list($protected, $payload, $signature) = $parts;
                $signatures[] = [ 
                    'unprotected' => [],
                    'protected' => $protected,
                    'signature' => $signature
                ];
                break;
            case self::JSON_FORMAT:
                $obj = json_decode($token, true);
                if ($obj == null) throw new InvalidTokenException('Cannot decode JSON', InvalidTokenException::TOKEN_PARSE_ERROR);
                $payload = $obj['payload'];
                if (isset($obj['signatures'])) {
                    foreach ($obj['signatures'] as $signature_obj) {
                        if (!isset($signature_obj['protected']) || !isset($signature_obj['signature']))
                            throw new InvalidTokenException('Missing protected or signature member', InvalidTokenException::TOKEN_PARSE_ERROR);
                        $signature = [
                            'unprotected' => [],
                            'protected' => $signature_obj['protected'],
                            'signature' => $signature_obj['signature']
                        ];
                        if (isset($signature_obj['header'])) $signature['unprotected'] = $signature_obj['header'];
                        $signatures[] = $signature;
                    }
                } else {
                    if (!isset($obj['protected']) || !isset($obj['signature']))
                        throw new InvalidTokenException('Missing protected or signature member', InvalidTokenException::TOKEN_PARSE_ERROR);
                    $signature = [
                        'unprotected' => [],
                        'protected' => $obj['protected'],
                        'signature' => $obj['signature']
                    ];
                    if (isset($obj['header'])) $signature['unprotected'] = $obj['header'];
                    $signatures[] = $signature;
                }
                break;
            default:
                throw new \InvalidArgumentException('Incorrect format');
        }
        $result['claims'] = json_decode(Util::base64url_decode($payload), true);
        if ($result['claims'] == null) throw new InvalidTokenException('Cannot decode claims', InvalidTokenException::TOKEN_PARSE_ERROR);
        $result['signatures'] = [];
        foreach ($signatures as $signature) {
            $headers = json_decode(Util::base64url_decode($signature['protected']), true);
            if ($headers == null) throw new InvalidTokenException('Cannot decode header', InvalidTokenException::TOKEN_PARSE_ERROR);
            $result['signatures'][] = [
                'headers' => array_merge($headers, $signature['unprotected']),
                'signing_input' => $signature['protected'] . '.' . $payload,
                'signature' => $signature['signature']
            ];
        };
        return $result;
    }
public static function deserialise ( $ token ) { $ detect_result = Helper :: detect ( $ token ) ; if ( $ detect_result == null ) throw new \ InvalidArgumentException ( 'Unrecognised token format' ) ; $ format = $ detect_result [ 'format' ] ; $ result = [ ] ; $ signatures = [ ] ; switch ( $ format ) { case self :: COMPACT_FORMAT : $ parts = explode ( '.' , $ token , 3 ) ; if ( count ( $ parts ) != 3 ) throw new InvalidTokenException ( 'Cannot decode compact serialisation' , InvalidTokenException :: TOKEN_PARSE_ERROR ) ; list ( $ protected , $ payload , $ signature ) = $ parts ; $ signatures [ ] = [ 'unprotected' => [ ] , 'protected' => $ protected , 'signature' => $ signature ] ; break ; case self :: JSON_FORMAT : $ obj = json_decode ( $ token , true ) ; if ( $ obj == null ) throw new InvalidTokenException ( 'Cannot decode JSON' , InvalidTokenException :: TOKEN_PARSE_ERROR ) ; $ payload = $ obj [ 'payload' ] ; if ( isset ( $ obj [ 'signatures' ] ) ) { foreach ( $ obj [ 'signatures' ] as $ signature_obj ) { if ( ! isset ( $ signature_obj [ 'protected' ] ) || ! isset ( $ signature_obj [ 'signature' ] ) ) throw new InvalidTokenException ( 'Missing protected or signature member' , InvalidTokenException :: TOKEN_PARSE_ERROR ) ; $ signature = [ 'unprotected' => [ ] , 'protected' => $ signature_obj [ 'protected' ] , 'signature' => $ signature_obj [ 'signature' ] ] ; if ( isset ( $ signature_obj [ 'header' ] ) ) $ signature [ 'unprotected' ] = $ signature_obj [ 'header' ] ; $ signatures [ ] = $ signature ; } } else { if ( ! isset ( $ obj [ 'protected' ] ) || ! isset ( $ obj [ 'signature' ] ) ) throw new InvalidTokenException ( 'Missing protected or signature member' , InvalidTokenException :: TOKEN_PARSE_ERROR ) ; $ signature = [ 'unprotected' => [ ] , 'protected' => $ obj [ 'protected' ] , 'signature' => $ obj [ 'signature' ] ] ; if ( isset ( $ obj [ 'header' ] ) ) $ signature [ 'unprotected' ] = $ obj [ 'header' ] ; $ signatures [ ] = $ signature ; } break ; default : throw new \ InvalidArgumentException ( 'Incorrect format' ) ; } $ result [ 'claims' ] = json_decode ( Util :: base64url_decode ( $ payload ) , true ) ; if ( $ result [ 'claims' ] == null ) throw new InvalidTokenException ( 'Cannot decode claims' , InvalidTokenException :: TOKEN_PARSE_ERROR ) ; $ result [ 'signatures' ] = [ ] ; foreach ( $ signatures as $ signature ) { $ headers = json_decode ( Util :: base64url_decode ( $ signature [ 'protected' ] ) , true ) ; if ( $ headers == null ) throw new InvalidTokenException ( 'Cannot decode header' , InvalidTokenException :: TOKEN_PARSE_ERROR ) ; $ result [ 'signatures' ] [ ] = [ 'headers' => array_merge ( $ headers , $ signature [ 'unprotected' ] ) , 'signing_input' => $ signature [ 'protected' ] . '.' . $ payload , 'signature' => $ signature [ 'signature' ] ] ; } ; return $ result ; }
Deserialises a JWT without checking its validity.
Deserialises a JWT without checking its validity .