src/SecureString.php
public function decode($str, array $spec, $throw = false) {
        $decodeFirst = false;
        $wstr = $str; // wstr means working string
        $used = [];

        $strict = true;
        if (array_key_exists(self::STRICT, $spec)) {
            $strict = (bool)$spec[self::STRICT];
            unset($spec[self::STRICT]);
        }

        while ($token = $this->popString($wstr)) {
            if ($token === self::EOS) {
                if ($decodeFirst) {
                    $wstr = static::base64urlDecode($wstr);
                }
                break;
            }

            try {
                $supported = $this->supportedInfo($token, true);
            } catch (\Exception $ex) {
                return $this->exception($throw, $ex->getMessage(), 403);
            }

            if (!isset($spec[$token])) {
                return $this->exception($throw, "You did not provide a password for $token.", 403);
            }
            $password = $spec[$token];
            array_unshift($used, $token);

            list(, $decode, $method, $decodeFirst) = $supported;

            switch ($decode) {
                case 'decrypt':
                    $wstr = $this->decrypt($wstr, $method, $password, $throw);
                    break;
                case 'verifyHmac':
                    $wstr = $this->verifyHmac($wstr, $method, $password, $throw);
                    break;
                default:
                    return $this->exception($throw, "Invalid method $decode.", 500);
            }

            if ($wstr === null) {
                return null;
            }
        }

        // Make sure that the string was secured at all.
        if ($strict && array_keys($spec) != $used) {
            return $this->exception($throw, 'The string is not fully secure.', 403);
        } elseif (empty($used)) {
            return $this->exception($throw, 'The string is not secure.', 403);
        }

        $data = json_decode($wstr, true);
        if ($data === null) {
            return $this->exception($throw, 'The final string is not valid json.', 403);
        }

        return $data;
    }
public function decode($str, array $spec, $throw = false) {
        $decodeFirst = false;
        $wstr = $str; // wstr means working string
        $used = [];

        $strict = true;
        if (array_key_exists(self::STRICT, $spec)) {
            $strict = (bool)$spec[self::STRICT];
            unset($spec[self::STRICT]);
        }

        while ($token = $this->popString($wstr)) {
            if ($token === self::EOS) {
                if ($decodeFirst) {
                    $wstr = static::base64urlDecode($wstr);
                }
                break;
            }

            try {
                $supported = $this->supportedInfo($token, true);
            } catch (\Exception $ex) {
                return $this->exception($throw, $ex->getMessage(), 403);
            }

            if (!isset($spec[$token])) {
                return $this->exception($throw, "You did not provide a password for $token.", 403);
            }
            $password = $spec[$token];
            array_unshift($used, $token);

            list(, $decode, $method, $decodeFirst) = $supported;

            switch ($decode) {
                case 'decrypt':
                    $wstr = $this->decrypt($wstr, $method, $password, $throw);
                    break;
                case 'verifyHmac':
                    $wstr = $this->verifyHmac($wstr, $method, $password, $throw);
                    break;
                default:
                    return $this->exception($throw, "Invalid method $decode.", 500);
            }

            if ($wstr === null) {
                return null;
            }
        }

        // Make sure that the string was secured at all.
        if ($strict && array_keys($spec) != $used) {
            return $this->exception($throw, 'The string is not fully secure.', 403);
        } elseif (empty($used)) {
            return $this->exception($throw, 'The string is not secure.', 403);
        }

        $data = json_decode($wstr, true);
        if ($data === null) {
            return $this->exception($throw, 'The final string is not valid json.', 403);
        }

        return $data;
    }
Decode a string that was encoded using {@link SecureString::encode()}.

@param string $str The encoded string.
@param array $spec An array specifying how the string should be encoded.
@param bool $throw Whether or not to throw an exception on error.
@return string|null Returns the decoded string or null of there was a problem.