Skip to content

Issue with base64 decoding when using sodium_crypto #596

Open
@beryllium

Description

@beryllium

I've encountered an issue with base64 decoding in JWT::sign and JWT::verify. The sodium_crypto_* methods were rejecting the $key value for having an incorrect number of bytes.

The public key I was using containing URL-encoded characters, per the JWK RFC recommendations, and it seems like they are getting skipped by base64_decode.

It seems that ::sign and ::verify should be updated to use self::urlsafeB64Decode instead of base64_decode.

I am able to work around the issue by applying JWT::convertBase64UrlToBase64 to the public key strings before hydrating the Key objects.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions