Repository navigation
Support padding = signs in Base64 encoding #49
Description
https://github.com/brianloveswords/node-jws/blob/master/lib/verify-stream.js#L8 forbids = characters from appearing: however, I came across one web service that used = as Base64 padding. https://jwt.io uses jwt.js, which can parse the token without issue; however, this library complains that this is an invalid token.
Reacted by João Vieira
Activity
omsmith commentedon Apr 24, 2016
Hi @zhuowei
I have to suggest you report a bug to the service in question, they are not complying with the specification.
#22 #38 #25 #30
gdamjan commentedon Feb 23, 2019
maybe we should be more practical here.
does allowing for = padding have any inadvertent effects?
omsmith commentedon Feb 23, 2019
Incompatibility with the rest of the ecosystem. Libraries exist across many languages, and node.js alone has at least 5 of them. If we're lenient in accepting malformed signatures here, then the same issue will just be opened in other implementations "node.js' jws accepts this token, but your library does not". It is a vicious cycle.
There is a spec that clearly says to use base64-url. I don't plan to intentionally accept changes that diverge from it.
gdamjan commentedon Feb 25, 2019
the rust and python libraries I've used do work with the AWS token
omsmith commentedon Feb 25, 2019
We can find examples in both directions. I am aware that Microsoft's .NET library would not accept the token, for instance.