如何正确验证用户传递的含两个点的有效JWT Token？

I totally get where you're coming from—dealing with strings that look like JWTs (with two dots) but aren't actually valid can be tricky. Let's break down how to properly validate tokens so you can distinguish between:

• Non-JWT strings that happen to have two dots (like your http://example.org/token/123.123.123 example)
• Format-correct JWTs that are still invalid (e.g., wrong signature, expired, etc.)

Step 1: Handle Parsing Exceptions First #

The reason that non-JWT 2-dot string throws an exception is because lcobucci/jwt expects each segment of the JWT to be Base64Url encoded. Your example string's segments aren't valid Base64Url, so parsing fails immediately.

First, wrap your parsing logic in a try-catch block to catch these parsing errors. This lets you immediately flag those invalid 2-dot strings as non-JWTs.

Step 2: Perform Full Validation After Successful Parsing #

Once a token parses without errors, you still need to validate its cryptographic signature and any required claims (expiration, issuer, etc.) to ensure it's truly valid—not just structurally correct.

Here's a complete code example for lcobucci/jwt 3.2.x:

use Lcobucci\JWT\Parser;
use Lcobucci\JWT\ValidationData;
use Lcobucci\JWT\Signer\Hmac\Sha256;

function validateJwtToken(string $token, string $secret): bool
{
    try {
        // Parse the token first—this will fail for non-Base64Url segmented strings
        $parsedToken = (new Parser())->parse($token);
        
        // Validate the cryptographic signature
        $signer = new Sha256();
        if (!$signer->verify($parsedToken->getSignature(), $parsedToken->getPayload(), $secret)) {
            return false;
        }
        
        // Validate standard claims (adjust based on your application requirements)
        $validationData = new ValidationData();
        $validationData->setIssuer('your-application-issuer'); // Replace with your actual issuer
        $validationData->setCurrentTime(time()); // Checks expiration and "not before" claims
        
        return $parsedToken->validate($validationData);
    } catch (\Exception $e) {
        // Any exception here means the token isn't a valid JWT structure (even if it has two dots)
        return false;
    }
}

Key Notes: #

• Parsing vs. Validation: Parsing only checks if the token has the right structural format (3 Base64Url segments separated by dots). Validation goes further to confirm the token is cryptographically legitimate and meets your business rules.
• Exception Coverage: The catch block will handle errors like invalid Base64Url segments, malformed JSON in header/payload, or missing segments—exactly the issues with your example 2-dot string.
• Customize Claims: Tweak the ValidationData setup to match the claims your app relies on (e.g., add setAudience() if you use audience checks).

This approach ensures you first filter out any non-JWT strings (even those with two dots) and then properly validate the ones that pass structural checks.

内容的提问来源于stack exchange，提问作者Max Sky