search

jasongoodwin / authentikat-jwt

JWT Scala Implementation - Claims based auth for Scala.
Apache License 2.0
133 stars 45 forks source link

change base64 library and fixed signature #3

Closed yhuang8 closed 10 years ago

yhuang8 commented 10 years ago

when the string is too long, current version of base64 will add newline to the string which is not url safe.

secondly, according to this https://developer.atlassian.com/static/connect/docs/concepts/understanding-jwt.html the last encoded signature is wrong.

Concatenate the encoded header, a period character (.) and the encoded claims set. That gives you signingInput = encodedHeader+ "." + encodedClaims. Compute the signature of signingInput using the JWT or cryptographic library of your choice. Then base64 encode it. That gives you encodedSignature. concatenate the signing input, another period character and the signature, which gives you the JWT token. jwtToken = signingInput + "." + encodedSignature

jasongoodwin commented 10 years ago

Sorry for the late reply on this - been really busy. I'll check this out shortly - I agree with the base64 piece but I want to validate the second piece as I did do fairly thorough evaluation of the output against the spec.

jasongoodwin commented 10 years ago

BTW thank you so much!

yhuang8 commented 10 years ago

No problem. not in a hurry. =)

jasongoodwin commented 10 years ago

Thanks so much!

jasongoodwin commented 10 years ago

Hey this broke the tests for me so I reverted for now. I'll revisit later. Did you run the unit tests before creating a pr?

yhuang8 commented 10 years ago

sorry about that. I tested the one for my company but totally forgot running unit tests here. Will send out a new pr again. Thanks a lot!

jasongoodwin commented 10 years ago

No worries - would correct the tests but I'm hammered with competing tasks atm - really appreciate it.

Sent from my iPhone

On Sep 13, 2014, at 6:59 PM, Yan Huang notifications@github.com wrote:

sorry about that. I tested the one for my company but totally forgot running unit tests here. Will send out a new pr again. Thanks a lot!

— Reply to this email directly or view it on GitHub.