@@ -28,8 +28,8 @@ |
||
| 28 | 28 | 'use_strict_mode' => '1', // enable to prevent session fixation |
| 29 | 29 | 'use_trans_sid' => '0', // disable to prevent session fixation and hijacking |
| 30 | 30 | 'use_only_cookies' => '1', // disable session identifiers in the URLs |
| 31 | - 'cache_limiter' => '', // disable response headers |
|
| 32 | - 'referer_check' => '', // disable it, not a safe implementation (with substr() check) |
|
| 31 | + 'cache_limiter' => '', // disable response headers |
|
| 32 | + 'referer_check' => '', // disable it, not a safe implementation (with substr() check) |
|
| 33 | 33 | ]); |
| 34 | 34 | |
| 35 | 35 | if ($this->get('expire_at_browser_close')) { |
@@ -80,12 +80,12 @@ |
||
| 80 | 80 | $notBefore = $issuedAt + JWT::$leeway; // leeway for server clock discrepancies |
| 81 | 81 | |
| 82 | 82 | $payload = [ |
| 83 | - 'iat' => $issuedAt, // Token issued at timestamp |
|
| 84 | - 'jti' => $sessionId, // unique identifier for the token |
|
| 83 | + 'iat' => $issuedAt, // Token issued at timestamp |
|
| 84 | + 'jti' => $sessionId, // unique identifier for the token |
|
| 85 | 85 | //'iss' => '', // Issuer |
| 86 | - 'nbf' => $notBefore, // Not before timestamp |
|
| 86 | + 'nbf' => $notBefore, // Not before timestamp |
|
| 87 | 87 | 'exp' => $notBefore + $this->ttl, // Expire at timestamp |
| 88 | - 'data' => $sessionData, // The session data for the user |
|
| 88 | + 'data' => $sessionData, // The session data for the user |
|
| 89 | 89 | ]; |
| 90 | 90 | |
| 91 | 91 | $_SERVER['HTTP_AUTHORIZATION'] = JWT::encode($payload, $this->privateKey, 'HS256'); |