nov/json-jwt

Nimbus JOSE+JWT IV additional character being ignored

bharatshivram opened this issue · 4 comments

bharatshivram commented

I am using Nimbus JOSE+JWT library. If we add ONE extra character to the BASE64URL encoded IV and try decoding the same using Base64Codec.java it yields the same result. The last additional character is being ignored.

`String encodedValue = "e_DQ6gm5gGsGfWnh";
// encodedValue = "e_DQ6gm5gGsGfWnha"
Base64URL encodedIV = new Base64URL(encodedValue);

byte[] out = encodedIV.decode();
// The trailing 'h' does not make a difference to the decoded value

`

nov commented

what’s your issue?

bharatshivram commented

The issue is why is the trailing character being ignored?

bharatshivram commented

I see from the code comments that the implementation Specifically ignores the invalid characters like whitespaces, new lines. Just wanted to know why such a decision was taken to make the API lenient

nov commented

Why you are asking it to me?
I'm not Nimbus JOSE developer.