Base64 decoder should not ignore illegal characters about jjwt HOT 1 OPEN

Hi @laurids! This was a design decision in the early days of JJWT in the spirit of the "robustness principle". The main reason being that illegal Base64 characters in the beginning or the end from people trying to 'trick' signature comparisons doesn't actually change the underlying signature, so there is no reason to fail: if the signature is confirmed successfully (from a cryptographic perspective), people trying to 'play games' doesn't impact the security properties of the underlying signature/mac algorithm (which would otherwise be 'security by obscurity' and therefore useless).

We can keep this issue open to track changing the behavior, but this implementation has been around for 8-9 years now; odds are high that existing usages depend on this behavior, so we'd probably only be able to change this on a major release or next significant point release.

As you mention, at least until we feel we can/should change the code, the easiest workaround is to use a (fairly simple) custom Base64Url decoder per https://github.com/jwtk/jjwt#custom-base64.

Thanks for creating the issue!

from jjwt.