I would advocate throwing a logic exception here, as it's good to check for
these things, but this should never be broken unless the implementer of the
library has done something wrong.

Sincerely,
Brent Shaffer
@bshaffer <http://twitter.com/bshaffer>


On Mon, Jan 21, 2013 at 4:23 PM, F21 <notifications@github.com> wrote:

> In src/OAuth2/GrantType/JWTBearer.php:
>
> >
> > -            return null;
> > +        if (!empty($diff)) {
> > +
> > +            $this->response = new OAuth2_Response_Error(400, 'invalid_grant', "Invalid issuer (iss) or subject (sub) provided");
>
> Yes, that is true, however from the client's point of view, the cause of
> the parameters being incorrect would be because they had an invalid iss or
> sub.
>
> Having said that, Perhaps it might be better to remove this after all,
> because having an invalid iss and sub will be the only issues for causing
> an error, and this is already being done in getClientDataFromRequest().
>
> —
> Reply to this email directly or view it on GitHub<https://github.com/bshaffer/oauth2-server-php/pull/38/files#r2719620>.
>
>