search

square / go-jose

An implementation of JOSE standards (JWE, JWS, JWT) in Go
1.98k stars 276 forks source link

Unencoded Payload Option WithBase64 still encodes payload to base64 through MarshalJSON? #372

Closed smo4201 closed 1 year ago

smo4201 commented 2 years ago

As far as I understand, go-jose implements the JSON Web Signature (JWS) Unencoded Payload Option (https://www.rfc-editor.org/rfc/rfc7797) via the SigningOption: func (*SignerOptions) WithBase64.

I tried setting this option via: opt := (&jose.SignerOptions{}).WithBase64(false), but it still leads to a base64 encoded payload when using full serialization. The option is indeed evaluated and the payload is not base64 encoded in signing.go (https://github.com/square/go-jose/blob/v2/signing.go#L291), but then, in the FullSerialize() the rawJSONWebSignature containing a Payload *byteBuffer is serialized.

For the byteBuffer, a custom JSON Marshalling method is implemented in encoding.go (https://github.com/square/go-jose/blob/v2/encoding.go#L142) and this method always encodes base64: 

func (b *byteBuffer) MarshalJSON() ([]byte, error) {
    return json.Marshal(b.base64())
}

Did I do something wrong using the WithBase64() option or doesn't this mean setting WithBase64 still leads to base64-encoded payload?