owncloud / ocis-php-sdk

Apache License 2.0
3 stars 1 forks source link

Decoding of tokens fails in some cases #208

Closed PhMemmel closed 4 months ago

PhMemmel commented 4 months ago

Some tokens including special characters cannot be decoded properly by function base64_decode used here:

https://github.com/owncloud/ocis-php-sdk/blob/e7d6cd211e46a8a7d8f3b94f1db2ef5352061176/src/Ocis.php#L239

Here is an example token which fails:

eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJPbmxpbmUgSldUIEJ1aWxkZXIiLCJpYXQiOjE3MDgzMjU2MjEsImV4cCI6MTczOTg2MTYyMSwiYXVkIjoid3d3LmV4YW1wbGUuY29tIiwic3ViIjoianJvY2tldEBleGFtcGxlLmNvbSIsIkdpdmVuTmFtZSI6IkJhcnR1IiwiU3VybmFtZSI6Ikt1cnV0bHVvxJ9sdSIsIkVtYWlsIjoianJvY2tldEBleGFtcGxlLmNvbSIsIlJvbGUiOlsiTWFuYWdlciIsIlByb2plY3QgQWRtaW5pc3RyYXRvciJdLCJEaXNwbGF5IE5hbWUiOiJCYXJ0dSBLdXJ1dGx1b8SfbHUifQ.3s4NiJYFIqzwgAY0yTlCYEkruMAafWUTJJwtEH2Br0I

The token will be properly decoded by \Firebase\JWT\JWT::urlsafeB64Decode for example.

individual-it commented 4 months ago

the payload of that token does decode correctly for me with PHP 8.1 and this code (excerpt of the code we use in the SDK).

The problem with the token is not the base64 decoding but that iss does not contain a valid host

PHP code to decode token ```php
PhMemmel commented 4 months ago

Further debugging shows that the issue is most likely not the special chars, but the fact, that the tokens are base64-url-encoded, thus need to be handled as such.

individual-it commented 4 months ago

e.g. base64_encode('//~') would cause that problem, because it encodes to Ly9+

The real problem is that JWT does not use base64 but base64Url: https://jwt.io/introduction/ The payload is then Base64Url encoded to form the second part of the JSON Web Token.