Using CachedKeySet causes an Exception thrown by openssl_verify()

[Brunty]

ErrorException: openssl_verify(): supplied key param cannot be coerced into a public key in /var/www/html/vendor/firebase/php-jwt/src/JWT.php:293

I've tried with both a Redis cache and a Filesystem cache (provided by the Symfony Cache Component).

The first time the code is called and it doesn't have anything in the cache, it works fine. The second time it's called I get the above error.

[Brunty]

Writing a basic "store the JWKs in cache and fetch on next request" type implementation myself yields the same error.

Looking at what's fetched from a call to get JWKs with a PSR client (via a var_dump()):

["kid_goes_here"]=> object(Firebase\JWT\Key)#2022 (2) { ["keyMaterial":"Firebase\JWT\Key":private]=> resource(643) of type (OpenSSL key) ["algorithm":"Firebase\JWT\Key":private]=> string(5) "RS256" }

vs what comes out of the cache:

["kid_goes_here"]=> object(Firebase\JWT\Key)#2027 (2) { ["keyMaterial":"Firebase\JWT\Key":private]=> int(0) ["algorithm":"Firebase\JWT\Key":private]=> string(5) "RS256" }

Looks like it's not serializing the OpenSSL key properly before inserting into the cache (which it can't, because it's a resource), so in the cache the keyMaterial just gets inserted as int(0): O:16:"Firebase\JWT\Key":2:{s:29:"Firebase\JWT\KeykeyMaterial";i:0;

So then when it's fetched, it doesn't turn into a valid openssl key resource, so doesn't work with openssl_verify()

[BenjaminFavre]

Starting with PHP 8, openssl_pkey_get_public() returns an instance of OpenSSLAsymmetricKey, which is not serializable by design.

I suggest to cache only the JWKS string, so there is no serialization issue and the cache is still very effective because it avoids unnecessary network calls to the JWKS URI.

[Brunty]

Yeah.

The current process is Fetch -> Parse -> Cache

IMO it should be Fetch -> Cache -> Parse

[brandomeniconi]

+1 here, even using phpfastcache:files as the example suggested.

[bshaffer]

Thank you for finding and fixing this. This should now be fixed in v6.3.0!