Repository navigation
JWT Bearer auth crash with php-jwt v6 (JWT::decode(): Argument #3 ($headers) could not be passed by reference) #25
Description
Summary
Bearer authentication crashes with a fatal error when using newer firebase/php-jwt versions (v6+):
PHP Fatal error: Uncaught Error: Firebase\JWT\JWT::decode(): Argument #3 ($headers) could not be passed by reference in /usr/ictcore/core/User.php:473
This happens in User::authenticate() during Bearer token decode.
Root Cause
core/User.php uses legacy decode signature:
JWT::decode($access_key, $public_key, array($hash_type));This is compatible with older firebase/php-jwt (v5), but not with v6+, which expects Firebase\JWT\Key.
Why not pin to v5
Attempting to pin to firebase/php-jwt:^5.5 was blocked by Composer security advisory policy (known advisories on v5.x).
So pinning to v5 is not a safe/viable long-term fix.
Fix
Update to v6-compatible API:
use Firebase\JWT\JWT;
+use Firebase\JWT\Key;
...
-$token = JWT::decode($access_key, $public_key, array($hash_type));
+$token = JWT::decode($access_key, new Key($public_key, $hash_type));Expected Result
Bearer authentication works with maintained/supported firebase/php-jwt versions (v6+), no fatal error.
Additional Context
Observed in Docker-based deployment of ICTFax, where the auth endpoint and protected routes trigger the Bearer decode path.
Issue drafted with assistance from GitHub Copilot (analysis and troubleshooting steps).
Activity
Fix Bearer auth JWT decode for php-jwt v6+
tahiralmas commentedon Sep 7, 2026
Confirmed, and thanks for the precise write-up. Your diagnosis is right on both counts:
core/User.phpused the v5 three-argumentJWT::decode(), and pinning back tofirebase/php-jwt5.x is not a real option given the advisories against that line.Two things worth adding.
There were two v5 call sites, not one. Besides
User::authenticate(),Forgot_password::token_decode()had the same pattern on the password-reset path, so that one would have fataled next.The fix has landed on the
php83branch (PR #23), which moves the whole dependency set off pre-PHP-8 versions and takesfirebase/php-jwtto 7.x.Forgot_passwordwas already converted there;core/User.phpwas the one file the branch had missed, so Bearer auth would have broken the moment that branch merged. Fixed in a2acc98, exactly as you proposed:JWT::encode()needed no change, since both call sites already pass the algorithm explicitly.Leaving this open until #23 merges, then it closes with it. Good catch on a path that would otherwise have surfaced as a fatal in production.
Build the image on PHP 8.3 to match the dependencies this branch move…