chiefbiiko/base64

base64 strings from/to Uint8Arrays

base64's Issues

Reclaim Your $KSM Today

padding characters '=' needs to be added to the end of a base64url-encoded string

Hi I saw you made a reference in your code to this paragraph:

For this reason, modified Base64 for URL variants exist (such as base64url in RFC 4648), where the '+' and '/' characters of standard Base64 are respectively replaced by '-' and '_', so that using URL encoders/decoders is no longer necessary and have no impact on the length of the encoded value, leaving the same encoded form intact for use in relational databases, web forms, and object identifiers in general. Some variants allow or require omitting the padding '=' signs to avoid them being confused with field separators, or require that any such padding be percent-encoded.

Unfortunately you only implemented the optional base64url decoding for the - and _ characters. The padding characters are not added back automatically to convert a URL-safe base64 string which obviously changes the base64 string length. This conversion is important for all JWT, JWS and JWE implementations. I changed it for myself with the following function based on this example in the JWS specification.

function addPaddingCharactersToBase64url(base64url: string): string {
  if (base64url.length % 4 === 2) return base64url + "=="
  if (base64url.length % 4 === 3) return base64url + "="
  if (base64url.length % 4 === 1) throw new TypeError("Illegal base64url string!")
  return base64url
}

Could I maybe convince you that adding this option is a good idea?