Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:119247
Message-ID: <df7b363b-b178-36ec-9765-fbeed7ecfef7@bastelstu.be>
Date: Mon, 9 Jan 2023 21:11:54 +0100
MIME-Version: 1.0
Content-Language: en-US
To: Sara Golemon <pollita@php.net>, PHP internals <internals@lists.php.net>
References: <CAESVnVo3NyM_RGybyLQSko0F=fBSnSWG3gkVZtU-DS8W=79fdA@mail.gmail.com>
In-Reply-To: <CAESVnVo3NyM_RGybyLQSko0F=fBSnSWG3gkVZtU-DS8W=79fdA@mail.gmail.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit
Subject: Re: [PHP-DEV] base64url format
From: tim@bastelstu.be (=?UTF-8?Q?Tim_D=c3=bcsterhus?=)

Hi

On 1/9/23 19:49, Sara Golemon wrote:
> I've been working with JWTs lately and that means working with Base64URL
> format. (Ref: https://www.rfc-editor.org/rfc/rfc4648#section-5 )
> This is essentially the same thing as normal Base64, but instead of '+' and
> '/', it uses '-' and '_', respectively. It also allows leaving off the
> training '=' padding characters.
> 

With JWTs you likely also want a constant time encoder that is not 
susceptible for cache-timing leaks [1]. For this reason 
https://github.com/paragonie/constant_time_encoding is a most-have 
dependency for my projects and I generally use the functions of that 
library by default, unless there is a reason not to (high performance 
required). That library also includes a b32 implementation that cmb wished.

There's also 
https://www.php.net/manual/en/function.sodium-bin2base64.php which is 
constant-time and supports b64url, unfortunately it's not guaranteed to 
be available.

Best regards
Tim Düsterhus

[1] It's likely more important for encrypted tokens, than only for 
signed ones.