Jwt-auth: Possible security bug

[yunier0525]

I'm using jwt-auth in two separate applications with Laravel 5.3. And I have verified that I can authenticate in one of the applications with a token generated by the other application, in that case the application authenticates me as long as I have a user with the same id.

I have reviewed the jwt-auth code and found that to authenticate it only verifies that the token can be decoded, and in that case logs the user through the id.

I recommend that the encoding be done in combination with the key of the application generated by key: generate.

Please correct me if I am wrong.

[pankitgami]

In your .env file, do you have a two different JWT_SECRET?

[yunier0525]

Sorry is an copy/paste issue. I just regenerate the JWT_SECRET and is working properly now.

Thanks !