Re: base64 URL decode - for jwt

Hi Jack,

with all due respect - but no.

URL encoding a string and then Base64 encoding it, is not what Base64URL means.

Base64URL is a sub-scheme of Base64 and is used to encode chunks of binary information in a way, that can be transmitted inside an URL.

Therefore the Base64 encoding is applied, but the sextet code points, that would normally result in the characters "+" (111110) and "/" (111111) are replaced with the URL safe characters "-" and "_". The valueless padding character "=" in omitted (or optional).

Let's say you would encode the following string (without the quotes hopefully the UTF-8 chars come thru correctly):

"ϏϿ"

If we were going your way to URL encode that first, and then Base64-ing it:

URL Encode: %CF%8F%CF%BF
Base64: JUNGJThGJUNGJUJG

Also Base64 first and URL encode the result is wrong:

Base64: z4/Pvw==
URL Encode: z4%2FPvw%3D%3D

In fact the correct result is:

Base64URL: z4_Pvw
or alternatively: z4_Pvw==

The Base64URL encoding can be created by Base64 encoding, and then:

replace "+" with "-"
replace "/" with "_"
strip off "=" and the end

Therefor decoding it, is applying these steps backwards.

Kind regards,
Daniel

Am 04.03.2025 um 23:25 schrieb Jack Woehr via MIDRANGE-L <midrange-l@xxxxxxxxxxxxxxxxxx>:

apologies, safelinks apparently crapped up my post.
The point is that if you urlencode a url and then base64 encode it, that's what you're looking for, what you're calling "base64url".
And then you can reverse the steps to reverse the process.
________________________________
From: MIDRANGE-L <midrange-l-bounces@xxxxxxxxxxxxxxxxxx> on behalf of Jack Woehr via MIDRANGE-L <midrange-l@xxxxxxxxxxxxxxxxxx>
Sent: Tuesday, March 4, 2025 15:21
To: midrange-l@xxxxxxxxxxxxxxxxxx <midrange-l@xxxxxxxxxxxxxxxxxx>
Cc: Jack Woehr <jack.woehr@xxxxxxxxxxx>
Subject: Re: base64 URL decode - for jwt

CAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you recognize the sender and know the content is safe.

I think you misunderstood my example.
Maybe this makes it clearer:

$ php -a
Interactive shell

php > $url = 'https://foo.bar.com/woof?arf=%22some string"';
php > $urlencoded = urlencode($url);
php > var_dump($urlencoded);
string(58) "https%3A%2F%2Ffoo.bar.com%2Fwoof%3Farf%3D%22some+string%22"
php > $urlencoded_base64encoded = base64_encode($urlencoded);
php > var_dump($urlencoded_base64encoded);
string(80) "aHR0cHMlM0ElMkYlMkZmb28uYmFyLmNvbSUyRndvb2YlM0ZhcmYlM0QlMjJzb21lK3N0cmluZyUyMg=="
php > print(urldecode(base64_decode($urlencoded_base64encoded)));
https://foo.bar.com/woof?arf=%22some<https://foo.bar.com/woof?arf=%22some> string"

________________________________
From: MIDRANGE-L <midrange-l-bounces@xxxxxxxxxxxxxxxxxx> on behalf of Daniel Gross <daniel@xxxxxxxx>
Sent: Tuesday, March 4, 2025 14:06
To: midrange-l@xxxxxxxxxxxxxxxxxx <midrange-l@xxxxxxxxxxxxxxxxxx>
Subject: Re: base64 URL decode - for jwt

Hi Jack,

base64 != base64url



Jack Woehr
Independent Consulting Programmer

303-847-8442

jack.woehr@xxxxxxxxxxx

http://www.procern.com/<http://www.procern.com/>

Stay Connected!

Not Just MSP, We Also MSSP.

 NON-DISCLOSURE NOTICE: This communication including any and all attachments is for the intended recipient(s) only and may contain confidential and privileged information. If you are not the intended recipient of this communication, any disclosure, copying further distribution or use of this communication is prohibited. If you received this communication in error, please contact the sender and delete/destroy all copies of this communication immediately.
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/midrange-l<https://lists.midrange.com/mailman/listinfo/midrange-l>
or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives
at https://archive.midrange.com/midrange-l<https://archive.midrange.com/midrange-l>.

Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription related questions.



Jack Woehr
Independent Consulting Programmer

303-847-8442

jack.woehr@xxxxxxxxxxx

http://www.procern.com/

Stay Connected!

Not Just MSP, We Also MSSP.

 NON-DISCLOSURE NOTICE: This communication including any and all attachments is for the intended recipient(s) only and may contain confidential and privileged information. If you are not the intended recipient of this communication, any disclosure, copying further distribution or use of this communication is prohibited. If you received this communication in error, please contact the sender and delete/destroy all copies of this communication immediately.
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives
at https://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription related questions.