Backwards compatibility break in 6.1.0 release with empty payload

[sjaakkie]

Hi,

There's a backwards compatibility break in the 6.1.0 release.
If you add an empty array as payload the error "Payload must be a JSON object" pops up if you decode the JWT.

How to reproduce

use Firebase\JWT\JWT;
use Firebase\JWT\Key;

$key = 'yma6Hq4XQegCVND8ef23OYgxSrC3IKqk';
$payload = [];

$jwt = JWT::encode($payload, $key, 'HS256');
$decoded = JWT::decode($jwt, new Key($key, 'HS256'));

Current (version 6.1.0) behaviour
An error pops up in JWT.php line 115 with the message "Payload must be a JSON object"

Expected (version 6.0.0) behaviour
No error occur when decoding JWT.
Variable $decoded is an empty array

Please take a look at this.

Kind regards

[bshaffer]

This is a bit of a dicy issue. We should have been supplying the flag JSON_FORCE_OBJECT to the function json_encode (which is called by JWT::encode) in v6.0. Typing was added for stdClass in v6.1, but it was always supposed to be a stdClass, even in v6.0, and an empty PHP array ([]) by default is encoded as a JSON array instead of an object.

We can set the flag JSON_FORCE_OBJECT when json_encode is called in JWT::encode, but this will technically constitute a BC break between v6.1.0 and v6.1.1. I think it's a benign enough change to make, however.

Thanks for pointing this out!

[bshaffer]

Fixed in v6.1.1

[sjaakkie]

Thanks for fixing this!