title: Jjwt throws signature error when validates a jwt token generated from php
body: <p>I need to add a PHP application in a SSO built using a CAS in Java.
  After authentication of the user, the SSO sends the credintials to the PHP App and the token is built using the code below:</p>
  
  <pre><code>public function getToken(Signer $signer = null, Key $key = null)
      {
          $signer = $signer ?: $this-&gt;signer;
          $key = $key ?: $this-&gt;key;
  
          if ($signer instanceof Signer) {
              $signer-&gt;modifyHeader($this-&gt;headers);
          }
  
          $payload = [
              $this-&gt;encoder-&gt;base64UrlEncode($this-&gt;encoder-&gt;jsonEncode($this-&gt;headers)),
              $this-&gt;encoder-&gt;base64UrlEncode($this-&gt;encoder-&gt;jsonEncode($this-&gt;claims))
          ];
  
          $signature = $this-&gt;createSignature($payload, $signer, $key);
  
          if ($signature !== null) {
              $payload[] = $this-&gt;encoder-&gt;base64UrlEncode($signature);
          }
  
          return new Token($this-&gt;headers, $this-&gt;claims, $signature , $payload);
      }
  
      private function createSignature(array $payload, Signer $signer = null, Key $key = null)
      {
          if ($signer === null || $key === null) {
              return null;
          }
          return $signer-&gt;sign(implode('.', $payload), $key);
      }
  </code></pre>
  
  <p>So I try to validate the generated token using java, as bellow:</p>
  
  <pre><code> public boolean validateToken(String authToken) {
          try {
              Jwts.parser().setSigningKey(secretKey).parseClaimsJws(authToken);
              return true;
          } catch (SignatureException e) {
              log.info("Invalid JWT signature.");
              log.trace("Invalid JWT signature trace: {}", e);
              e.printStackTrace();
          }
          ....
      }
  </code></pre>
  
  <p>To validade the signature, the jjwt splits the 3 parts of the token and tries to sign the 2 firsts parts using the algorithm provided in the header of the token. This step is the same used to create the signature of the token when the token is created. Theoretically, using the same algorithm, paylod and secret in both steps, creation and valitadion, the signature shoud be the same. 
  But it does not happen.
  The following excpetion is thrown: </p>
  
  <blockquote>
    <p>io.jsonwebtoken.SignatureException: JWT signature does not match locally computed signature. JWT validity cannot be asserted and should not be trusted.</p>
  </blockquote>