Deprecated
Table of Contents
JwtAlgorithm.php
| Line | Element | Reason |
|---|---|---|
| 57 | JwtAlgorithm::NONE | Disallowed in practice for any security-bearing token. Many libraries reject it by default; clients MUST NOT accept it without explicit opt-in. |
| 111 | JwtAlgorithm::RSA1_5 | Vulnerable to Bleichenbacher-style attacks; prefer self::RSA_OAEP_256. |
OAuth2CodeChallengeMethod.php
| Line | Element | Reason |
|---|---|---|
| 48 | OAuth2CodeChallengeMethod::PLAIN | Provides no protection against a passive observer
intercepting the authorization response. RFC 7636
requires servers to support self::S256 and
only allows |
OAuth2GrantType.php
| Line | Element | Reason |
|---|---|---|
| 101 | OAuth2GrantType::PASSWORD | Disallowed by OAuth 2.1 and RFC 9700 (Security BCP). Exposes user credentials to the client and prevents multi-factor authentication. Kept for legacy interoperability only; prefer self::AUTHORIZATION_CODE with PKCE. |
| 115 | OAuth2GrantType::IMPLICIT | Removed by OAuth 2.1 and disallowed by RFC 9700 (Security BCP) because of access-token leakage via redirect URIs and browser history. Use self::AUTHORIZATION_CODE with PKCE instead. |
OAuth2ResponseType.php
| Line | Element | Reason |
|---|---|---|
| 71 | OAuth2ResponseType::TOKEN | Disallowed by OAuth 2.1 and RFC 9700 (Security BCP). Use self::CODE with PKCE instead. |
| 115 | OAuth2ResponseType::ID_TOKEN_TOKEN | Like self::TOKEN, the implicit flow is discouraged by RFC 9700. |
OAuth2TokenType.php
| Line | Element | Reason |
|---|---|---|
| 91 | OAuth2TokenType::MAC | The MAC token type IETF draft has expired and is not a published RFC. Exposed only for completeness; prefer self::DPOP for sender-constrained tokens. |