Open
Description
I've encountered an issue with base64 decoding in JWT::sign
and JWT::verify
. The sodium_crypto_* methods were rejecting the $key
value for having an incorrect number of bytes.
The public key I was using containing URL-encoded characters, per the JWK RFC recommendations, and it seems like they are getting skipped by base64_decode
.
It seems that ::sign
and ::verify
should be updated to use self::urlsafeB64Decode
instead of base64_decode
.
I am able to work around the issue by applying JWT::convertBase64UrlToBase64
to the public key strings before hydrating the Key
objects.
Metadata
Metadata
Assignees
Labels
No labels