From b956081432cb35080070eecde45997210322789e Mon Sep 17 00:00:00 2001 From: Matt Glaman Date: Wed, 7 Oct 2026 19:26:36 -0500 Subject: [PATCH] [Server] Pad EC key coordinates in the JWKS test fixture MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit OpenSSL returns P-256 coordinates without leading zero bytes, so about 1 in 100 generated keys has a 31-byte x or y. RFC 7518 requires 32 bytes, and with the lowest dependencies the key is rejected and testFromIssuerTagsKeysWithoutAlgorithmPerToken fails. 🤖 Assisted with AI --- .../Server/Transport/Http/OAuth/JwtTokenValidatorTest.php | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/tests/Unit/Server/Transport/Http/OAuth/JwtTokenValidatorTest.php b/tests/Unit/Server/Transport/Http/OAuth/JwtTokenValidatorTest.php index 10c4643a..e8e3784a 100644 --- a/tests/Unit/Server/Transport/Http/OAuth/JwtTokenValidatorTest.php +++ b/tests/Unit/Server/Transport/Http/OAuth/JwtTokenValidatorTest.php @@ -293,11 +293,14 @@ public function testFromIssuerTagsKeysWithoutAlgorithmPerToken(): void $rsaDetails = openssl_pkey_get_details($rsaKey); $this->assertIsArray($ecDetails); $this->assertIsArray($rsaDetails); + // OpenSSL drops leading zero bytes, but a P-256 JWK coordinate must be 32 bytes (RFC 7518 §6.2.1.2). + $ecX = str_pad($ecDetails['ec']['x'], 32, "\0", \STR_PAD_LEFT); + $ecY = str_pad($ecDetails['ec']['y'], 32, "\0", \STR_PAD_LEFT); $factory = new Psr17Factory(); $client = $this->jwksClient($factory, [ ['kty' => 'RSA', 'kid' => 'kid-1', 'n' => self::base64Url($rsaDetails['rsa']['n']), 'e' => self::base64Url($rsaDetails['rsa']['e'])], - ['kty' => 'EC', 'kid' => 'ec-1', 'crv' => 'P-256', 'x' => self::base64Url($ecDetails['ec']['x']), 'y' => self::base64Url($ecDetails['ec']['y'])], + ['kty' => 'EC', 'kid' => 'ec-1', 'crv' => 'P-256', 'x' => self::base64Url($ecX), 'y' => self::base64Url($ecY)], ]); $validator = JwtTokenValidator::fromIssuer(self::ISSUER, self::AUDIENCE, new ArrayAdapter(), $client, $factory, ['RS256', 'ES256']);