Firebase Tokens Laravel Package

Added support for PHP 8.5

Fixed deprecated implicit nullable parameter

Added support for PHP 8.4 (#61)

• Restored support for PHP 8.1
• Fixed missing signature check when in non-emulated environments (#56)

Added support for PHP 8.3

Fixed ID Token verification when run in emulated environments.

Added support for PHP 8.3, removed support for PHP 8.1

Added support for the Firebase Auth Emulator when using lcobucci/jwt 5.*

Note: The Kreait\Firebase\JWT\Token class has been renamed to \Kreait\Firebase\JWT\SecureToken. This is technically a breaking change, but since the *Verifier classes type-hint \Kreait\Firebase\JWT\Contract\Token as return values, I consider it unlikely that this should cause trouble for most people. If it does, I'll deal with the consequences.

Added support for lcobucci/jwt 5.*

The most notable change is that you need PHP 8.1/8.2 to use the new version. The language migration to PHP 8.1 introduces potentially breaking changes concerning the strictness of parameter types - however, this should not affect your project in most cases (unless you have used internal classes directly or by extension).

Please see UPGRADE-4.0.md for detailed information.

Ensured (PHPStan) compatibility with lcobucci/jwt ^4.2

Dropped support for lcobucci/jwt 3.x

Ensure compatibility with lcobucci/jwt ^4.2

Ensure (PHPStan) compatibility with lcobucci/jwt ^4.2

Ensure compatibility with lcobucci/jwt ^4.2

Raised minimum version of Guzzle to address CVE-2022-31090 and CVE-2022-31091

Raise minimum version of Guzzle to address CVE-2022-31042

Implemented forward-compatible Clock-Interface

The stella-maris/clock package provides an interface based on the currently proposed status of PSR-20. Due to the inactivity of the PSR20 working group this is a way to already provide interoperability while still maintaining forward compatibility. When the current status of PSR20 will be released at one point in time the stella-maris/clock package will extend the PSR-20 interface so that this package becomes immeadiately PSR20 compatible without any further work necessary.

• Removed firebase/php-jwt dev dependency and simplified test token generation.
• Added support for verifying tokens returned from the Auth Emulator.

If you or your team rely on this project and me maintaining it, please consider becoming a Sponsor 🙏

Added tenant support to Session Cookie Verification. It doesn't seem to be supported at the moment (executing it with a tenant-enabled Firebase project yields an UNSUPPORTED_TENANT_OPERATION) error, but once it is supported, this library will need no or just minimal updates.

The Firebase Admin SDK for PHP has integration tests checking for this error so that we know early on when it starts working.

Fixed method name Kreait\Firebase\JWT\SessionCookieVerifier::sessionCookieWithLeeway to Kreait\Firebase\JWT\SessionCookieVerifier::verifySessionCookieWithLeeway 🤦‍. This is technically a breaking change, but since 2.1.0 was released just a few minutes ago, it was most certainly not used yet.

Added Kreait\Firebase\JWT\SessionCookieVerifier that works similarly as the existing ID Token verifier. You can find its documentation in the README.

Fixed failing ID token verification when the nbf claim is not present.

After updating, please refer to the Migration Documentation.

• Removed Firebase\Auth namespace
• Ensured compatibility with PHP 8.1 by adding it to the test matrix.
• Dropped support for lcobucci/jwt <4.1
• Dropped support for guzzlehttp/guzzle <7.0
• Dropped direct support for psr/simple-cache

Update lcobucci/jwt version constraint to ^3.4.6|^4.0.4|^4.1.5 to prevent misuse of the LocalFileReference key.

More info: GHSA-7322-jrq4-x5hf

• Un-deprecated Firebase\Auth\Token\Domain\Generator, Firebase\Auth\Token\Domain\Verifier and \Firebase\Auth\Token\Domain\KeyStore
• Dropped support for unsupported PHP versions. Starting with this release, supported versions are PHP ^7.4 and PHP ^8.0.
• Allowed usage of psr/cache ^2.0|^3.0

• Use fallback cache duration (defaults to 1 hour) when fetching public keys from Google and the response doesn't contain cache headers.
• Add additional URL to fetch Google's public keys.

• Drop the V3 suffix from handlers using lcobucci/jwt
• Limit support to PHP 8.0.*

Added support for PHP 8.0

• Added Tenant Awareness
• Fixed usage of deprecated functionality from lcobucci/jwt