Oauth2-server: [5.1.4] V5 Security Improvement not backward compatible

[halaei]

Setting the new $encryptionKey parameter will invalidate the already generated refresh tokens. Not setting that will give the headache of too many error logs :(.
Not a backward compatible change at all :(

[vigneshgurusamy]

@alexbilbie In addition to that, we have to make web server user as owner for public key. Because the latest update trying to set 600 permission to public key.

[xuxucode]

As vigneshgurusamy said, the chmod() leads to an exception raised:

Warning: chmod(/home/myname/example-project/certificates/public.key): Operation failed:
Operation not permitted in League\OAuth2\Server\CryptKey->__construct() (line 51 of
/home/myname/example-project/vendor/league/oauth2-server/src/CryptKey.php)

[leandrose]

This implemented broke a lot, example if you are testing using apache I have to change the owner to www-data, and with that I can not use php artisan passport: install.

*sorry my english

[iget-esoares]

Also have the things broken here.

The file ownership breakes many laravel commands, including tinker

[gemal]

the implementation is wrong
if ($keyPathPerms !== '600') {

you cant say that this is the perfect permission.
you might have set up the file with permission to the group
which you then have
'660'

please revert this

[alexbilbie]

I'm going to release an update that doesn't hard error but just throws warnings instead

[gemal]

I still think is some cases even a warning is wrong
My folder is protect correct and is not 600 but is protected according to all security manuals.

[alexbilbie]

I have released 5.1.5 which replaces the hard errors with notices and deprecation warnings.

It is correct behaviour that the key should be owned by the server process to prevent possibility of token forgery by replacing the server’s public key or leakage of the key by an attacker or rogue other process.