Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Allow strict base64 decoding #259

Merged
merged 1 commit into from
Dec 9, 2022
Merged

Allow strict base64 decoding #259

merged 1 commit into from
Dec 9, 2022

Commits on Dec 2, 2022

  1. Allow strict base64 decoding 

    By default base64 decoder works in non-strict mode which
allows tweaking signatures having padding without failing validation.

This creates a potential problem if application treats token value as an identifier.

For example ES256 signature has length of 64 bytes and two padding symbols (stripped by default).
Therefore its base64-encoded value can only end with A, Q, g and w.
In non-strict mode last symbol could be tweaked resulting in 16 distinct
token values having the same signature and passing validation.

This change adds backward-compatible global config variable DecodeStrict
(similar to existing DecodePaddingAllowed) that enables strict base64 decoder mode.

See also golang/go#15656.

Signed-off-by: Alexander Yastrebov <yastrebov.alex@gmail.com>
    @AlexanderYastrebov
    AlexanderYastrebov committed Dec 2, 2022
    Configuration menu
    Copy the full SHA
    84f2800 View commit details
    Browse the repository at this point in the history