Update security.md

[kwn]

TLDR

Small fix for the authentication docs. The example from the docs currently doesn't work.

Details

In the latest version of the Lcobucci\JWT package getToken() method returns Lcobucci\JWT\Token\Plain object. authenticate() method expects first parameter to be a string. Plain class doesn't have __toString() method implemented, so passing an instance of the Plain class to the authenticate() method throws an exception.

Apparently Lcobucci introduced a new method called payload() to the Plain class, so in order to get a string representation of the JWT token we need to call it explicitly.

[acrobat]

Hi @kwn, thanks for the PR! If I read the lcobucci/jwt code correctly the payload method does return something different than the __toString method

Deprecated __toString method:

https://github.com/lcobucci/jwt/blob/511629a54465e89a31d3d7e4cf0935feab8b14c1/src/Token.php#L410-L429

Payload method:

https://github.com/lcobucci/jwt/blob/511629a54465e89a31d3d7e4cf0935feab8b14c1/src/Token.php#L394-L402

So it would actually be better to update the example to call $token->toString() so that the expected result is the same.

[glaubinix]

I can confirm that calling $token->toString() is the correct method to call to receive the token to authenticate against GitHub

[acrobat]

Closing this in favor of #1017

[kwn]

Thanks for sorting it out and sorry for a late reply 👍