Potentially the empty token could be treated as signed

[SCIF]

This is unlikely a security vulnerability but rather bad coding: https://github.com/lexik/LexikJWTAuthenticationBundle/blob/3.x/Services/JWSProvider/LcobucciJWSProvider.php#L103-L106

        $e = $token = null;
        try {
            $token = $this->getSignedToken($jws);
        } catch (\InvalidArgumentException) {
        }

        return new CreatedJWS((string) $token, null === $e);

In case InvalidArgumentException was thrown the token will be casted to '' and second argument will be true so the empty token will be considered as properly formed and signed.

[SCIF]

I assume the original idea was to override $e on line 103:

} catch (\InvalidArgumentException $e) {

[chalasr]

Yes, that’s a a regular bug

[SCIF]

Hi @chalasr , thanks for the confirmation! Any idea why InvalidArgumentException could be ignored? To me this looks like a bad practice

[chalasr]

It was a bad move to uncapturing catches. Fixed and simplified in #1267