@@ -28,8 +28,8 @@ |
||
28 | 28 | 'use_strict_mode' => '1', // enable to prevent session fixation |
29 | 29 | 'use_trans_sid' => '0', // disable to prevent session fixation and hijacking |
30 | 30 | 'use_only_cookies' => '1', // disable session identifiers in the URLs |
31 | - 'cache_limiter' => '', // disable response headers |
|
32 | - 'referer_check' => '', // disable it, not a safe implementation (with substr() check) |
|
31 | + 'cache_limiter' => '', // disable response headers |
|
32 | + 'referer_check' => '', // disable it, not a safe implementation (with substr() check) |
|
33 | 33 | ]); |
34 | 34 | |
35 | 35 | if ($this->get('expire_at_browser_close')) { |
@@ -80,12 +80,12 @@ |
||
80 | 80 | $notBefore = $issuedAt + JWT::$leeway; // leeway for server clock discrepancies |
81 | 81 | |
82 | 82 | $payload = [ |
83 | - 'iat' => $issuedAt, // Token issued at timestamp |
|
84 | - 'jti' => $sessionId, // unique identifier for the token |
|
83 | + 'iat' => $issuedAt, // Token issued at timestamp |
|
84 | + 'jti' => $sessionId, // unique identifier for the token |
|
85 | 85 | //'iss' => '', // Issuer |
86 | - 'nbf' => $notBefore, // Not before timestamp |
|
86 | + 'nbf' => $notBefore, // Not before timestamp |
|
87 | 87 | 'exp' => $notBefore + $this->ttl, // Expire at timestamp |
88 | - 'data' => $sessionData, // The session data for the user |
|
88 | + 'data' => $sessionData, // The session data for the user |
|
89 | 89 | ]; |
90 | 90 | |
91 | 91 | $_SERVER['HTTP_AUTHORIZATION'] = JWT::encode($payload, $this->privateKey, 'HS256'); |