Issue with receiving array on aud.

[andresleecom]

checkClaimType its not accepting arrays and when there is an array for example on aud, validation breaks.

"aud": [
    "one",
    "two"
],

public function __construct(string $token)
{
    Validation::checkTokenStructure($token);
    
    $elements = explode('.', $token);
    list($header, $payload, $signature) = $elements;
    
    $headerArray = json_decode(Base64Url::decode($header), true);
    $payloadArray = json_decode(Base64Url::decode($payload), true);
    
    Validation::checkAlgorithmDefined($headerArray);
    Validation::checkAlgorithmSupported($headerArray['alg']);
    Validation::checkSignatureMissing($signature);
    
    Validation::checkClaimType('nbf', 'integer', $payloadArray);
    Validation::checkClaimType('exp', 'integer', $payloadArray);
    Validation::checkClaimType('iat', 'integer', $payloadArray);
    
    Validation::checkClaimType('iss', 'string', $payloadArray);
    Validation::checkClaimType('sub', 'string', $payloadArray);
    Validation::checkClaimType('aud', 'string', $payloadArray);
    Validation::checkClaimType('jti', 'string', $payloadArray);
    
    $this->token = $token;
    $this->payload = $payload;
    $this->header = $header;
    $this->signature = $signature;
}

public static function checkClaimType(string $claim, string $type, array $payload): void
{
    switch ($type) {
        case 'integer':
            if (array_key_exists($claim, $payload) && ! is_int($payload[$claim])) {
                throw new InvalidClaimTypeException(sprintf('Invalid %s claim - %s value required', $claim, $type));
            }
            break;
        case 'string':
        default:
            if (array_key_exists($claim, $payload) && ! is_string($payload[$claim])) {
                throw new InvalidClaimTypeException(sprintf('Invalid %s claim - %s value required', $claim, $type));
            }
            break;
    }
}

[burgfels]

I have the same issue. it does only support the special case as mentioned in 4.1.3 "aud" (Audience) Claim (https://datatracker.ietf.org/doc/html/rfc7519#section-4.1.3))
... In the general case, the "aud" value is an array of case- sensitive strings, each containing a StringOrURI value. In the special case when the JWT has one audience, the "aud" value MAY be a single case-sensitive string containing a StringOrURI value. ...

I'm sure, there are other(better) solutions. This is mine:

public function __construct(string $token)
    {
        Validation::checkTokenStructure($token);
        
        $elements = explode('.', $token);
        list($header, $payload, $signature) = $elements;
        
        $headerArray = json_decode(Base64Url::decode($header), true);
        $payloadArray = json_decode(Base64Url::decode($payload), true);
        
        Validation::checkAlgorithmDefined($headerArray);
        Validation::checkAlgorithmSupported($headerArray['alg']);
        Validation::checkSignatureMissing($signature);
        
        Validation::checkClaimType('nbf', 'integer', $payloadArray);
        Validation::checkClaimType('exp', 'integer', $payloadArray);
        Validation::checkClaimType('iat', 'integer', $payloadArray);
        
        Validation::checkClaimType('iss', 'string', $payloadArray);
        Validation::checkClaimType('sub', 'string', $payloadArray);
-       Validation::checkClaimType('aud', 'string', $payloadArray);
+       Validation::checkClaimType('aud', 'stringOrArrayOfString', $payloadArray);
        Validation::checkClaimType('jti', 'string', $payloadArray);
        
        $this->token = $token;
        $this->payload = $payload;
        $this->header = $header;
        $this->signature = $signature;
    }

public static function checkClaimType(string $claim, string $type, array $payload): void
    {
        switch ($type) {
            case 'integer':
                if (array_key_exists($claim, $payload) && ! is_int($payload[$claim])) {
                    throw new InvalidClaimTypeException(sprintf('Invalid %s claim - %s value required', $claim, $type));
                }
                break;
+           case 'stringOrArrayOfString':
+               if (array_key_exists($claim, $payload) && is_array($payload[$claim])) {
+                 foreach ($payload[$claim] as $key=>$v) {
+                   if (! is_string($payload[$claim][$key])) {
+                       throw new InvalidClaimTypeException(sprintf('Invalid %s claim - %s value required', $claim.'.'.$key, $type));
+                   }
+                 }
+                 break;
+               }
            case 'string':
            default:
                if (array_key_exists($claim, $payload) && ! is_string($payload[$claim])) {
                    throw new InvalidClaimTypeException(sprintf('Invalid %s claim - %s value required', $claim, $type));
                }
                break;
        }
    }