Invalid header padding

[johnmba]

I have been trying to encode and decode my token for mor than a day now but I keep getting a traceback error. I have searched and tried different approach to check if I can get a different error but all have failed.

Expected Result

I was expecting to get the payload like below: {"some": "payload"}

Actual Result

I got some traceback error like below: Traceback (most recent call last): File "/home/johnmba/.local/share/virtualenvs/Account-HtVojxm6/lib/python3.11/site-packages/jwt/api_jws.py", line 263, in _load header_data = base64url_decode(header_segment) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/home/johnmba/.local/share/virtualenvs/Account-HtVojxm6/lib/python3.11/site-packages/jwt/utils.py", line 33, in base64url_decode return base64.urlsafe_b64decode(input_bytes) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/usr/lib/python3.11/base64.py", line 134, in urlsafe_b64decode return b64decode(s) ^^^^^^^^^^^^ File "/usr/lib/python3.11/base64.py", line 88, in b64decode return binascii.a2b_base64(s, strict_mode=validate) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ binascii.Error: Incorrect padding

The above exception was the direct cause of the following exception:

Traceback (most recent call last): File "/home/johnmba/.local/share/virtualenvs/Account-HtVojxm6/lib/python3.11/site-packages/flask/app.py", line 2213, in call return self.wsgi_app(environ, start_response) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/home/johnmba/.local/share/virtualenvs/Account-HtVojxm6/lib/python3.11/site-packages/flask/app.py", line 2193, in wsgi_app response = self.handle_exception(e) ^^^^^^^^^^^^^^^^^^^^^^^^ File "/home/johnmba/.local/share/virtualenvs/Account-HtVojxm6/lib/python3.11/site-packages/flask_restful/init.py", line 298, in error_router return original_handler(e) ^^^^^^^^^^^^^^^^^^^ File "/home/johnmba/.local/share/virtualenvs/Account-HtVojxm6/lib/python3.11/site-packages/flask_restful/init.py", line 298, in error_router return original_handler(e) ^^^^^^^^^^^^^^^^^^^ File "/home/johnmba/.local/share/virtualenvs/Account-HtVojxm6/lib/python3.11/site-packages/flask_restful/init.py", line 298, in error_router return original_handler(e) ^^^^^^^^^^^^^^^^^^^ [Previous line repeated 1 more time] File "/home/johnmba/.local/share/virtualenvs/Account-HtVojxm6/lib/python3.11/site-packages/flask_restful/init.py", line 295, in error_router return self.handle_error(e) ^^^^^^^^^^^^^^^^^^^^ File "/home/johnmba/.local/share/virtualenvs/Account-HtVojxm6/lib/python3.11/site-packages/flask_restful/init.py", line 310, in handle_error _handle_flask_propagate_exceptions_config(current_app, e) File "/home/johnmba/.local/share/virtualenvs/Account-HtVojxm6/lib/python3.11/site-packages/flask/app.py", line 2190, in wsgi_app response = self.full_dispatch_request() ^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/home/johnmba/.local/share/virtualenvs/Account-HtVojxm6/lib/python3.11/site-packages/flask/app.py", line 1486, in full_dispatch_request rv = self.handle_user_exception(e) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/home/johnmba/.local/share/virtualenvs/Account-HtVojxm6/lib/python3.11/site-packages/flask_restful/init.py", line 298, in error_router return original_handler(e) ^^^^^^^^^^^^^^^^^^^ File "/home/johnmba/.local/share/virtualenvs/Account-HtVojxm6/lib/python3.11/site-packages/flask_restful/init.py", line 298, in error_router return original_handler(e) ^^^^^^^^^^^^^^^^^^^ File "/home/johnmba/.local/share/virtualenvs/Account-HtVojxm6/lib/python3.11/site-packages/flask_restful/init.py", line 298, in error_router return original_handler(e) ^^^^^^^^^^^^^^^^^^^ [Previous line repeated 1 more time] File "/home/johnmba/.local/share/virtualenvs/Account-HtVojxm6/lib/python3.11/site-packages/flask_restful/init.py", line 295, in error_router return self.handle_error(e) ^^^^^^^^^^^^^^^^^^^^ File "/home/johnmba/.local/share/virtualenvs/Account-HtVojxm6/lib/python3.11/site-packages/flask_restful/init.py", line 310, in handle_error _handle_flask_propagate_exceptions_config(current_app, e) File "/home/johnmba/.local/share/virtualenvs/Account-HtVojxm6/lib/python3.11/site-packages/flask/app.py", line 1484, in full_dispatch_request rv = self.dispatch_request() ^^^^^^^^^^^^^^^^^^^^^^^ File "/home/johnmba/.local/share/virtualenvs/Account-HtVojxm6/lib/python3.11/site-packages/flask/app.py", line 1469, in dispatch_request return self.ensure_sync(self.view_functions[rule.endpoint])(view_args) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/home/johnmba/.local/share/virtualenvs/Account-HtVojxm6/lib/python3.11/site-packages/flask_restful/init.py", line 489, in wrapper resp = resource(args, kwargs) ^^^^^^^^^^^^^^^^^^^^^^^^^ File "/home/johnmba/.local/share/virtualenvs/Account-HtVojxm6/lib/python3.11/site-packages/flask/views.py", line 109, in view return current_app.ensure_sync(self.dispatch_request)(kwargs) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/home/johnmba/.local/share/virtualenvs/Account-HtVojxm6/lib/python3.11/site-packages/flask_restful/init.py", line 604, in dispatch_request resp = meth(args, kwargs) ^^^^^^^^^^^^^^^^^^^^^ File "/home/johnmba/flaskproject/Account/src/setting/decs.py", line 170, in call (func := self.func(instance)) ^^^^^^^^^^^^^^^^^^^^ File "/home/johnmba/flaskproject/Account/src/setting/decs.py", line 96, in call auth = self.authenticate() ^^^^^^^^^^^^^^^^^^^ File "/home/johnmba/flaskproject/Account/src/setting/decs.py", line 74, in authenticate data = jwt.decode(token, "secrete", algorithms=["HS256"]) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/home/johnmba/.local/share/virtualenvs/Account-HtVojxm6/lib/python3.11/site-packages/jwt/api_jwt.py", line 210, in decode decoded = self.decode_complete( ^^^^^^^^^^^^^^^^^^^^^ File "/home/johnmba/.local/share/virtualenvs/Account-HtVojxm6/lib/python3.11/site-packages/jwt/api_jwt.py", line 151, in decode_complete decoded = api_jws.decode_complete( ^^^^^^^^^^^^^^^^^^^^^^^^ File "/home/johnmba/.local/share/virtualenvs/Account-HtVojxm6/lib/python3.11/site-packages/jwt/api_jws.py", line 198, in decode_complete payload, signing_input, header, signature = self._load(jwt) ^^^^^^^^^^^^^^^ File "/home/johnmba/.local/share/virtualenvs/Account-HtVojxm6/lib/python3.11/site-packages/jwt/api_jws.py", line 265, in _load raise DecodeError("Invalid header padding") from err jwt.exceptions.DecodeError: Invalid header padding

Reproduction Steps

import jwt
the encoding is in this format
token = jwt.encode(payload={"some": "payload"}, key="secret", algorithm='HS256')

and it was decode like in below:
jwt.decode(token, "secrete", algorithms=["HS256"])

System Information

$ python -m jwt.help

{
  "cryptography": {
    "version": ""
  },
  "implementation": {
    "name": "CPython",
    "version": "3.11.3"
  },
  "platform": {
    "release": "5.15.90.1-microsoft-standard-WSL2",
    "system": "Linux"
  },
  "pyjwt": {
    "version": "2.7.0"
  }
}

This command is only available on PyJWT v1.6.3 and greater. Otherwise, please provide some basic information about your system.

[Viicos]

Can you please provide more info on how the token was encoded? Was it encoded with PyJWT as well?

You can paste your token on https://jwt.io to see if you have errors as well.

[johnmba]

I recently came across a video on YouTube titled Microservice architecture and system design with Flask from freecodecamp; in the video I realized that the instructor accessed the token by

token = request.headers.get("authorization", None)
token = token.split(" ")[1]

Before the decoding the token

jwt.decode(token, "secret", "SHA256")

The approach worked though accessing the token this way

token = request.headers.get("authorization", None)

worked in my project before my python and liberaries upgrade.

[Viicos]

Can you please provide more info on how the token was encoded? Was it encoded with PyJWT as well?

You can paste your token on https://jwt.io to see if you have errors as well.

^ Can you please provide info about this?

[github-actions[bot]]

This issue is stale because it has been open 60 days with no activity. Remove stale label or comment or this will be closed in 7 days

[johnmba]

This issue has been resolved, I think because the token was sent as a bearer token, so the token is read as a string with space, so splitting the string on the space will return a list of bearer and token that is tkn = ['bearer', 'token'] subscripting tkn at one tkn[1] will return the original token.