ucan-wg/ts-ucan

Should encode tokens in base64 without padding & url-safe

matheus23 opened this issue · 0 comments

Specifically,

ts-ucan/src/base64.ts

Lines 4 to 10 in bfbdbda

export function decode(base64: string, encoding: Encodings = 'base64pad'): string {
return uint8arrays.toString(uint8arrays.fromString(base64, encoding))
}
export function encode(str: string, encoding: Encodings = 'base64pad'): string {
return uint8arrays.toString(uint8arrays.fromString(str), encoding)
}

Should use base64url, not base64pad.

If you paste in a UCAN generated by ts-ucan into https://jwt.io, you'll see some warnings about padding generated.

Also, the RFC 7515 demands that encoding should be base64url: https://datatracker.ietf.org/doc/html/rfc7515#section-2