3 ms·
It shouldn't, unless you base64 decode the header, then parse it with a library that causes the order to change, encode it again, and then use your own re-encod
by scandinavian 7y ago
It shouldn't, unless you base64 decode the header, then parse it with a library that causes the order to change, encode it again, and then use your own re-encoding to calculate the signature:
HMAC-SHA256(
b64(reencoded_header) + '.' + b64(payload),
secret
)
You should really just verify the signature for the provided header + payload in their base64 encoded form.