public function verifyIdToken($idToken, bool $checkIfRevoked = null, bool $allowTimeInconsistencies = null): Token
    {
        $checkIfRevoked = $checkIfRevoked ?? false;
        $allowTimeInconsistencies = $allowTimeInconsistencies ?? false;

        try {
            $verifiedToken = $this->idTokenVerifier->verifyIdToken($idToken);
        } catch (IssuedInTheFuture $e) {
            if (!$allowTimeInconsistencies) {
                throw $e;
            }

            $verifiedToken = $e->getToken();
        } catch (InvalidToken $e) {
            $verifiedToken = $idToken instanceof Token ? $idToken : (new Parser())->parse($idToken);

            if (stripos($e->getMessage(), 'authentication time') !== false) {
                $authTime = $verifiedToken->getClaim('auth_time', false);

                if ($authTime && !$allowTimeInconsistencies && $authTime > time()) {
                    throw $e;
                }
            } else {
                throw $e;
            }
        }

        if ($checkIfRevoked && $allowTimeInconsistencies) {
            throw new InvalidToken($verifiedToken, 'Allowing mismatching timestamps cannot be combined with token revokation checks.');
        }

        if ($checkIfRevoked) {
            $tokenAuthenticatedAt = DT::toUTCDateTimeImmutable($verifiedToken->getClaim('auth_time'));
            $validSince = $this->getUser($verifiedToken->getClaim('sub'))->tokensValidAfterTime;

            if ($validSince && ($tokenAuthenticatedAt < $validSince)) {
                throw new RevokedIdToken($verifiedToken);
            }
        }

        return $verifiedToken;
    }
public function verifyIdToken($idToken, bool $checkIfRevoked = null, bool $allowTimeInconsistencies = null): Token
    {
        $checkIfRevoked = $checkIfRevoked ?? false;
        $allowTimeInconsistencies = $allowTimeInconsistencies ?? false;

        try {
            $verifiedToken = $this->idTokenVerifier->verifyIdToken($idToken);
        } catch (IssuedInTheFuture $e) {
            if (!$allowTimeInconsistencies) {
                throw $e;
            }

            $verifiedToken = $e->getToken();
        } catch (InvalidToken $e) {
            $verifiedToken = $idToken instanceof Token ? $idToken : (new Parser())->parse($idToken);

            if (stripos($e->getMessage(), 'authentication time') !== false) {
                $authTime = $verifiedToken->getClaim('auth_time', false);

                if ($authTime && !$allowTimeInconsistencies && $authTime > time()) {
                    throw $e;
                }
            } else {
                throw $e;
            }
        }

        if ($checkIfRevoked && $allowTimeInconsistencies) {
            throw new InvalidToken($verifiedToken, 'Allowing mismatching timestamps cannot be combined with token revokation checks.');
        }

        if ($checkIfRevoked) {
            $tokenAuthenticatedAt = DT::toUTCDateTimeImmutable($verifiedToken->getClaim('auth_time'));
            $validSince = $this->getUser($verifiedToken->getClaim('sub'))->tokensValidAfterTime;

            if ($validSince && ($tokenAuthenticatedAt < $validSince)) {
                throw new RevokedIdToken($verifiedToken);
            }
        }

        return $verifiedToken;
    }
public function verifyIdToken ( $ idToken , bool $ checkIfRevoked = null , bool $ allowTimeInconsistencies = null ) : Token { $ checkIfRevoked = $ checkIfRevoked ?? false ; $ allowTimeInconsistencies = $ allowTimeInconsistencies ?? false ; try { $ verifiedToken = $ this -> idTokenVerifier -> verifyIdToken ( $ idToken ) ; } catch ( IssuedInTheFuture $ e ) { if ( ! $ allowTimeInconsistencies ) { throw $ e ; } $ verifiedToken = $ e -> getToken ( ) ; } catch ( InvalidToken $ e ) { $ verifiedToken = $ idToken instanceof Token ? $ idToken : ( new Parser ( ) ) -> parse ( $ idToken ) ; if ( stripos ( $ e -> getMessage ( ) , 'authentication time' ) !== false ) { $ authTime = $ verifiedToken -> getClaim ( 'auth_time' , false ) ; if ( $ authTime && ! $ allowTimeInconsistencies && $ authTime > time ( ) ) { throw $ e ; } } else { throw $ e ; } } if ( $ checkIfRevoked && $ allowTimeInconsistencies ) { throw new InvalidToken ( $ verifiedToken , 'Allowing mismatching timestamps cannot be combined with token revokation checks.' ) ; } if ( $ checkIfRevoked ) { $ tokenAuthenticatedAt = DT :: toUTCDateTimeImmutable ( $ verifiedToken -> getClaim ( 'auth_time' ) ) ; $ validSince = $ this -> getUser ( $ verifiedToken -> getClaim ( 'sub' ) ) -> tokensValidAfterTime ; if ( $ validSince && ( $ tokenAuthenticatedAt < $ validSince ) ) { throw new RevokedIdToken ( $ verifiedToken ) ; } } return $ verifiedToken ; }
Verifies a JWT auth token. Returns a Promise with the tokens claims. Rejects the promise if the token
could not be verified. If checkRevoked is set to true, verifies if the session corresponding to the
ID token was revoked. If the corresponding user's session was invalidated, a RevokedToken
exception is thrown. If not specified the check is not applied.

NOTE: Allowing time inconsistencies might impose a security risk. Do this only when you are not able
to fix your environment's time to be consistent with Google's servers. This parameter is here
for backwards compatibility reasons, and will be removed in the next major version. You
shouldn't rely on it.

@param Token|string $idToken the JWT to verify
@param bool $checkIfRevoked whether to check if the ID token is revoked
@param bool $allowTimeInconsistencies whether to allow tokens that have mismatching timestamps

@throws InvalidToken
@throws IssuedInTheFuture
@throws RevokedIdToken
@throws InvalidSignature

@return Token the verified token
Verifies a JWT auth token . Returns a Promise with the tokens claims . Rejects the promise if the token could not be verified . If checkRevoked is set to true verifies if the session corresponding to the ID token was revoked . If the corresponding user s session was invalidated a RevokedToken exception is thrown . If not specified the check is not applied .