Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

On ios device encoded string always have AAAAA in the end #61

Open
Grundmanis opened this issue Feb 3, 2017 · 3 comments
Open

On ios device encoded string always have AAAAA in the end #61

Grundmanis opened this issue Feb 3, 2017 · 3 comments

Comments

@Grundmanis
Copy link

Grundmanis commented Feb 3, 2017

Encoding example jwt.encode('test','some123kinda_!&salt?')
[android]
'test' = eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.InRlc3Qi.L4BH-TlaaPiRLvxtGHVNoJz7HkEreSeGt-k3sD7Koww
{foo: 'bar'} = eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJmb28iOiJiYXIifQ.3VlOJdTsvJ8WIwFihdMMikTpAHcEpLzDd3itvzYVdJ0
['Alex', 'Michael'] = eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.WyJBbGV4IiwiTWljaGFlbCJd.AiLX5nrNY3CXemdQ26ISw_KLbHR1FYCDHgzFGJx6ex4
12345 =eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.MTIzNDU.6e4vozTjtPuaLlfFNZvEv3sJMKXnN_dn1oETZEFl71k

[ios]
'test' = eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.InRlc3Qi.L4BH-TlaaPiRLvxtGHVNoJz7HkEreSeGt-k3sD7KowwAAAAA
{foo: 'bar'} = eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJmb28iOiJiYXIifQ.3VlOJdTsvJ8WIwFihdMMikTpAHcEpLzDd3itvzYVdJ0AAAAA
['Alex', 'Michael'] = eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.WyJBbGV4IiwiTWljaGFlbCJd.AiLX5nrNY3CXemdQ26ISw_KLbHR1FYCDHgzFGJx6ex4AAAAA
12345 =eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.MTIzNDU.6e4vozTjtPuaLlfFNZvEv3sJMKXnN_dn1oETZEFl71kAAAAA

@Grundmanis Grundmanis changed the title Encoding result with the same secret key and value is different on ios and linux On ios device encoded string always have AAAAA in the end Feb 7, 2017
@Grundmanis
Copy link
Author

Any ideas?

@zopthemop
Copy link

This is happening for us in Edge too, but it seems to repeat the last 3 letters of the token before appending AAAAA.

Tokens generated in Edge:

jwt.encode({query: "foo"}, 'jwtform', 'HS256')
"eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJxdWVyeSI6ImZvbyJ9.tUOJCqukb5sibTdAH6WNjUSD4opowurJbeVJp6aZpe8pe8AAAAA"
jwt.encode({query: "fooz"}, 'jwtform', 'HS256')
"eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJxdWVyeSI6ImZvb3oifQ.rzoaVpnWK7LjxE5SPp1O_3Ov1FxD6J_1YfdC3ieD3KU3KUAAAAA"

Tokens generated in Chrome:

jwt.encode({query: "foo"}, 'jwtform', 'HS256')
"eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJxdWVyeSI6ImZvbyJ9.tUOJCqukb5sibTdAH6WNjUSD4opowurJbeVJp6aZpe8"
jwt.encode({query: "fooz"}, 'jwtform', 'HS256')
"eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJxdWVyeSI6ImZvb3oifQ.rzoaVpnWK7LjxE5SPp1O_3Ov1FxD6J_1YfdC3ieD3KU"

Hope this can be fixed, because right now we can't continue using the library without some really ugly hacks.

@zopthemop
Copy link

Seems to be due to a hard-to-reproduce bug in crypto-browserify/createHmac, see issue: browserify/createHmac#12

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants