JwtCoder.php
protected function verifySignature($msg, $signature, $key, $method = 'HS256') 
  {
    if (empty(self::$methods[$method])) {
      throw new \DomainException('Algorithm not supported');
    }
    list($function, $algo) = self::$methods[$method];
    switch($function) {
      case 'openssl':
        $success = openssl_verify($msg, $signature, $key, $algo);
        if(!$success) {
          throw new \DomainException("OpenSSL unable to verify data: " . openssl_error_string());
        }
        return $signature;
        
      case 'hash_hmac':
      default:
        return $signature === hash_hmac($algo, $msg, $key, true);
    }
  }
protected function verifySignature($msg, $signature, $key, $method = 'HS256') 
  {
    if (empty(self::$methods[$method])) {
      throw new \DomainException('Algorithm not supported');
    }
    list($function, $algo) = self::$methods[$method];
    switch($function) {
      case 'openssl':
        $success = openssl_verify($msg, $signature, $key, $algo);
        if(!$success) {
          throw new \DomainException("OpenSSL unable to verify data: " . openssl_error_string());
        }
        return $signature;
        
      case 'hash_hmac':
      default:
        return $signature === hash_hmac($algo, $msg, $key, true);
    }
  }
protected function verifySignature ( $ msg , $ signature , $ key , $ method = 'HS256' ) { if ( empty ( self :: $ methods [ $ method ] ) ) { throw new \ DomainException ( 'Algorithm not supported' ) ; } list ( $ function , $ algo ) = self :: $ methods [ $ method ] ; switch ( $ function ) { case 'openssl' : $ success = openssl_verify ( $ msg , $ signature , $ key , $ algo ) ; if ( ! $ success ) { throw new \ DomainException ( "OpenSSL unable to verify data: " . openssl_error_string ( ) ) ; } return $ signature ; case 'hash_hmac' : default : return $ signature === hash_hmac ( $ algo , $ msg , $ key , true ) ; } }
Verify a signature with the mesage, key and method. Not all methods
are symmetric, so we must have a separate verify and sign method.
@param   string $msg the original message
@param   string $signature
@param   string|resource $key for HS*, a string key works. for RS*, must be a resource of an openssl public key
@param   string $method
@return  bool
@throws \DomainException Invalid Algorithm or OpenSSL failure
Verify a signature with the mesage key and method . Not all methods are symmetric so we must have a separate verify and sign method .