3 ms·
Doesn't anything using jwt depend on a specific order?
by aflag 7y ago
Doesn't anything using jwt depend on a specific order?
- scandinavian 7y agoIt shouldn't, unless you base64 decode the header, then parse it with a library that causes the order to change, encode it again, and then use your own re-encoding to calculate the signature: HMAC-SHA256( b64(reencoded_header) + '.' + b64(payload), secret ) You should really just verify the signature for the provided header + payload in their base64 encoded form.