RequestVerifier Class

Wraps an AuthenticationMethod instance to verify inbound request authentication data.

Can be used to verify authentication data in any PSR-7 RequestInterface with the verify() method.
Can be used to verify authentication data in any Symfony HttpFoundation Request with the verifySymfonyRequest() method.

Class Details

Constructor: __construct (AuthenticationMethod $method, KeyRepository $keys)
withRequestIdList (?RequestIdList $requestIdList): self
Adds a RequestIdList instance to this RequestVerifier which will be used to ensure Request ID Uniqueness for all valid inbound requests.
See Request IDs: Request Uniqueness for more information.
verify (Psr\Http\Message\RequestInterface $request): string
Takes a PSR-7 RequestInterface instance and checks the contained authentication token data. Side Effect: This will cause a StreamInterface::rewind() call on RequestInterface::getBody().
verifySymfonyRequest (Symfony\Component\HttpFoundation\Request $request): string
Takes a Symfony HttpFoundation Request instance and checks the contained authentication token data.
verifyGlobals (): string
Reads the PHP globals ($_SERVER and php://stdin) to read the current request (using RequestInfo::fromGlobals()) and checks the contained authentication token data.
Side Effect: This will open, read, rewind, and close php://stdin.

Return values:

On success, all verification methods return the client identification string as returned by AuthenticationMethod::getClientId().

Exceptions:

All verification methods throw a MissingAuthenticationHeaderException on missing or empty authentication header(s).
All verification methods throw a InvalidAuthenticationException on incorrect authentication header(s).
All verification methods throw a CryptoErrorException if there was a problem with a low-level cryptographic function.
All verification methods throw a DuplicateRequestIDException if the request was valid but contained an already-seen Request ID (requires withRequestIdList()).