Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:119248
MIME-Version: 1.0
References: <CAESVnVo3NyM_RGybyLQSko0F=fBSnSWG3gkVZtU-DS8W=79fdA@mail.gmail.com>
 <df7b363b-b178-36ec-9765-fbeed7ecfef7@bastelstu.be>
In-Reply-To: <df7b363b-b178-36ec-9765-fbeed7ecfef7@bastelstu.be>
Date: Mon, 9 Jan 2023 22:12:43 +0100
Message-ID: <CAJmy8YHex-g92EFRDYs7AwW0OfzbF9d4vAUqQim+RcP6Nn7EVQ@mail.gmail.com>
To: =?UTF-8?Q?Tim_D=C3=BCsterhus?= <tim@bastelstu.be>
Cc: Sara Golemon <pollita@php.net>, PHP internals <internals@lists.php.net>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Subject: Re: [PHP-DEV] base64url format
From: divinity76@gmail.com (Hans Henrik Bergan)

when http_build_query() wanted to support different encoding schemes,
PHP_QUERY_RFC1738 and PHP_QUERY_RFC3986 was made, instead of creating
http_build_query_rfc1738() and http_build_query_rfc3986() , hmm

On Mon, 9 Jan 2023 at 21:12, Tim D=C3=BCsterhus <tim@bastelstu.be> wrote:
>
> Hi
>
> On 1/9/23 19:49, Sara Golemon wrote:
> > I've been working with JWTs lately and that means working with Base64UR=
L
> > format. (Ref: https://www.rfc-editor.org/rfc/rfc4648#section-5 )
> > This is essentially the same thing as normal Base64, but instead of '+'=
 and
> > '/', it uses '-' and '_', respectively. It also allows leaving off the
> > training '=3D' padding characters.
> >
>
> With JWTs you likely also want a constant time encoder that is not
> susceptible for cache-timing leaks [1]. For this reason
> https://github.com/paragonie/constant_time_encoding is a most-have
> dependency for my projects and I generally use the functions of that
> library by default, unless there is a reason not to (high performance
> required). That library also includes a b32 implementation that cmb wishe=
d.
>
> There's also
> https://www.php.net/manual/en/function.sodium-bin2base64.php which is
> constant-time and supports b64url, unfortunately it's not guaranteed to
> be available.
>
> Best regards
> Tim D=C3=BCsterhus
>
> [1] It's likely more important for encrypted tokens, than only for
> signed ones.
>
> --
> PHP Internals - PHP Runtime Development Mailing List
> To unsubscribe, visit: https://www.php.net/unsub.php
>