Structured payloads to avoid key collisions about paseto HOT 2 CLOSED

Right now, the payload, as defined, seems to have only one key, exp.

https://github.com/paragonie/past/blob/master/src/Traits/RegisteredClaims.php

Of course, this depends if you're using the library's public API or writing arbitrary data directly to a token.

It seems like, somewhere and somewhen, somebody is going to try to stick a colliding key into the payload. Also, down the line, it strikes me that there may be additional metadata to add to the token (which could cause forward-upgrade issues for users with colliding keys). Maybe it'd be better for the basic payload structure to be:

{
  "exp": <expiry>,
  "d": <any legal JSON token>
}

Well, if you run this:

$parser = (new JsonToken())
    ->setPurpose('auth')
    ->setKey($someAuthKey)
    ->setIssuedAt(new DateTime())
    ->setExpiration(
        (new \DateTime())->add(
            new DateInterval('PT01H') // one hour
        )
    )
    ->set('d', $arbitrary_data_as_array);
var_dump((string) $parser);

...you'll see that you can define expiration, etc.

from paseto.

I suspect this may be a documentation issue, which has hopefully been resolved since January. Please feel free to correct me if I'm mistaken.

from paseto.