question-mark
Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Deterministic Base64 support

See original GitHub issue

This issue is being created to supersede similarly reported issues and represent a canonical issue to enable the following:

  1. Check to see if java.util.Base64 is available at runtime using Classes.isAvailable (or similar), and if so, use that. This is the best/fastest one available to most default environments and should be used whenever possible.

    java.util.Base64 is available on JDK >= 8 and Android level >= 26

  2. If java.util.Base64 is not available:

    1. If the runtime enviornment is Android, use android.util.Base64. This is available on Android API level >= 8 (i.e. >= Android 2.2, “Froyo”)

    2. Otherwise, assume < JDK8, and use javax.xml.bind.DatatypeConverter. JDK 7 has this included automatically.

  3. In any case, enable JwtBuilder and JwtParser methods that allow a user to specify their own Base64 TextCodec if/when desired, e.g. Jwts.parser().setBase64Codec(myBase64Codec) This last option would allow the user to enable Base64 support in any environment that doesn’t match 1 and 2 above.

  4. Ensure any codec implementation will throw exceptions on invalid inputs when possible. See #143 as an example. Exceptions should be thrown when possible to indicate invalid input, wrapping/propagating the original codec exception.

Implementation note: Perhaps instead of using javax.xml.bind.DatatypeConverter - which doesn’t always fail on invalid inputs (see #143), we should embed the Commons Codec or MigBase64 implementation.

Issue Analytics

  • State:closed
  • Created 5 years ago
  • Comments:20 (16 by maintainers)

github_iconTop GitHub Comments

1reaction
lhazlewoodcommented, Aug 1, 2018

This has been released in 0.10.0.

1reaction
lhazlewoodcommented, Jul 7, 2018

@azagniotov I’ve used migbase64 in production environments before, so I’m not too worried about that. That said, I’m adding tests for it anyway to ensure we still keep 100% coverage.

Read more comments on GitHub >

github_iconTop Results From Across the Web

Base64 Encoding of "deterministic" - Online
Encode deterministic to Base64 format with various advanced options. ... Encodes in real-time as you type or paste (supports only the UTF-8 character...
Read more >
Is Base64 deterministic (Apache Commons lib or otherwise)?
I'm using the Base64 encoder from the Apache Commons library. Now either something funny is going on with my runtime/IDE, or their ...
Read more >
deterministic-base64-json vulnerabilities | Snyk
Learn more about known vulnerabilities in the deterministic-base64-json package. Deterministically convert an object to a Base64 string and back.
Read more >
Should I decode a base64 password before hashing for ...
It is important that this encoding is deterministic (when the password is verified, it should use the same encoding as when it was...
Read more >
data_encoding - Rust - Docs.rs
... like base64, base32, and hex. This crate provides little-endian ASCII base-conversion encodings for bases of size 2, 4, 8, 16, 32, and...
Read more >

github_iconTop Related Medium Post

No results found

github_iconTop Related StackOverflow Question

No results found

github_iconTroubleshoot Live Code

Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free

github_iconTop Related Reddit Thread

No results found

github_iconTop Related Hackernoon Post

No results found

github_iconTop Related Tweet

No results found

github_iconTop Related Dev.to Post

No results found

github_iconTop Related Hashnode Post

No results found