Fix JWT Vulnerabilities (Weak Signing, None Algo) in FuelPHP

FuelPHP implementations often fall victim to JWT 'none' algorithm bypasses and HMAC secret brute-forcing when developers rely on outdated library patterns or weak configuration. If your decoding logic doesn't explicitly enforce the expected signing algorithm, an attacker can modify the JWT header to 'none', remove the signature, and impersonate any user. We are going to harden the implementation by enforcing strict algorithm whitelisting and utilizing high-entropy keys.

The Vulnerable Pattern

public function action_index() {
    $token = \Input::headers('Authorization');
    // VULNERABLE: No algorithm enforcement.
    // An attacker can set 'alg': 'none' in the header.
    // Also uses a weak, hardcoded secret.
    $decoded = \JWT::decode($token, 'secret_key');
    return $this->response((array) $decoded);
}

The Secure Implementation

1. **Algorithm Whitelisting**: The primary fix involves passing an explicit algorithm (e.g., 'HS256') via the Key object. This forces the library to ignore the 'alg' field in the JWT header, neutralizing 'none' attacks. 2. **Key Entropy**: The secret must be a cryptographically secure, long random string stored in an environment variable, not hardcoded in the FuelPHP controller. 3. **Library Versioning**: Ensure you are using `firebase/php-jwt` version 6.0 or higher, as older versions allowed the key to be passed as a string, which often led to developers omitting the algorithm parameter entirely. 4. **Strict Validation**: Always wrap the decode process in a try-catch block to handle expired (exp) or malformed tokens without leaking stack traces.

public function action_index() {
    $token = \Input::headers('Authorization');
    // SECURE: Retrieve high-entropy key from environment/config
    $key = \Config::get('jwt.secret_key');
try {
    // SECURE: Using firebase/php-jwt >= 6.0 logic
    // Explicitly defining the allowed algorithm (HS256) prevents 'none' and Key Confusion attacks.
    $decoded = \Firebase\JWT\JWT::decode(
        $token, 
        new \Firebase\JWT\Key($key, 'HS256')
    );
    return $this->response((array) $decoded);
} catch (\Exception $e) {
    // Log attempt and return generic 401
    return $this->response(['error' => 'Invalid Token'], 401);
}
}