Base64 error since v10.0.2

[maciek-szn]

Since updating to version 10.0.2, I can't send notifications to my subscribers. They fail with the following error. This is most likely a result of pull request #438, which replaced spomky-labs/base64url with web-token/jwt-library. It appears this change isn't backward compatible. Downgrading to 10.0.1 resolved the issue.

RangeException: Base64::decode() only expects characters in the correct base64 alphabet in /[...]/vendor/web-token/jwt-library/Core/Util/Base64UrlSafe.php:153
Stack trace:
#0 /[...]/vendor/minishlink/web-push/src/Encryption.php(79): Jose\Component\Core\Util\Base64UrlSafe::decode()
#1 /[...]/vendor/minishlink/web-push/src/Encryption.php(57): Minishlink\WebPush\Encryption::deterministicEncrypt()
#2 /[...]/vendor/minishlink/web-push/src/WebPush.php(252): Minishlink\WebPush\Encryption::encrypt()
#3 /[...]/vendor/minishlink/web-push/src/WebPush.php(148): Minishlink\WebPush\WebPush->prepare()
#4 [internal function]: Minishlink\WebPush\WebPush->flush()
#5 /[...]/vendor/minishlink/web-push/src/WebPush.php(118): Generator->current()
#6 /[...]/app/NotificationChannels/WebPush/WebPushChannel.php(29): Minishlink\WebPush\WebPush->sendOneNotification()

[...]

[Minishlink]

Thanks I'll create a 10.0.3 with #438 reverted. Do you have some example data to reproduce? CI tests haven't caught this

[maciek-szn]

Here is an example of a public key: BK6rMrh6WSnA/V6XB8sarpxp3vQ2eTxUKsiexiS687c/JuxoUAMrupLKl0UMVx6OxptOnZ/CVEO6oLnHR5sAimg=

There seems to be a problem with the +, /, = characters.

[Minishlink]

Thanks for the example public key :)

10.0.3 is created (#450)

cc @Rotzbua

[Rotzbua]

@maciek-szn Thanks for the example. Could you add the key in an additional test as PR?

[maciek-szn]

@Rotzbua I'm sorry, but I don't really know how to do this. I'd be happy to learn if someone else prepares a PR.

Thinking deeper about the cause of the problems, I came to the conclusion that the source is the implementation of the urlBase64ToUint8Array function, mentioned in the README. This is where the problematic +, /, and = characters appear. This implementation - incompatible with web-token/jwt-library - probably exists in thousands of places around the web, as it's sample code demonstrating how to implement web push notifications.

[Rotzbua]

This is where the problematic +, /, and = characters appear.

Good observation. That is the standard base64 encoding. The current push standard defines base64urlsafe as encoding. I guess older implementations and standards did use standard base64.

@maciek-szn Do you have information about the creation time of the subscription or used browser?

As solution for my newer implementation I think an automatic conversion to base64url should solve the problem.

[maciek-szn]

@maciek-szn Do you have information about the creation time of the subscription or used browser?

I don't have precise data, but new subscriptions are created on an ongoing basis. They come from Chrome/Chromium (usually https://fcm.googleapis.com/fcm/send/*), less often Firefox (https://updates.push.services.mozilla.com/wpush/v2/*), Edge (https://wns2-am3p.notify.windows.com/w/?token=*) and Safari (https://web.push.apple.com/*).