Proposal: using URL and filename safe base64 encoder for serializing macaroons
Closed this issue · 3 comments
Hi,
the current serialization format of macaroons uses Base64, as described in RFC 1521.
When using macaroons as bearer tokens in HTTP requests (e.g. query params)
this may cause problems, because Base64 uses characters like + and / for encoding.
There is an alternative: RFC 4648 (Oct.2006),
which describes Base 64 Encoding with URL and filename safe alphabet.
The changes in encoding are minimal: two alphabet characters changed and no padding is applied.
See also:
https://tools.ietf.org/html/rfc4648#section-5
What do you think about changing the serialization to base64url (the preferred name, as stated in the RFC).
Regards
Martin
I've got no objection to such a change. @rogpeppe, any objection to making this change in your implementation?
In any case, I suspect some decoders may just work with both formats, so we may be OK to change no matter what.
I've gone ahead and implemented this in a backwards compatible way. New macaroons will be serialized in base64url, while the decoder can parse both old and new forms.
👍
Followed with latest jmacaroons code :-)