kalugin66/windmill
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(debugger): properly decode base64url public key from JWKS

Browse Source 
The public key decoding from JWKS was missing base64url padding, causing
JWT signature verification to fail with "invalid jwt token" errors in
production. The `jwk.x` value needs proper padding before base64 decoding.

Fixed by using the existing `base64urlDecode` helper function which
correctly adds padding, instead of manually doing the conversion.

This resolves JWT verification failures when REQUIRE_SIGNED_DEBUG_REQUESTS
is enabled.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
This commit is contained in:
Ruben Fiszel
2026-01-13 19:47:31 +00:00
parent 9cddd28b9d
commit 8d005b030f
2 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
debugger/dap_debug_service.ts
View File

@@ -213,7 +213,7 @@ async function getPublicKey(): Promise<CryptoKey | null> {
}
// Decode the public key from base64url
const publicKeyBytes = Uint8Array.from(atob(jwk.x.replace(/-/g, '+').replace(/_/g, '/')), c => c.charCodeAt(0))
const publicKeyBytes = base64urlDecode(jwk.x)
// Import as Ed25519 public key
const key = await crypto.subtle.importKey(

2
debugger/dap_websocket_server_bun.ts
View File

@@ -186,7 +186,7 @@ async function getPublicKey(): Promise<CryptoKey | null> {
}
// Decode the public key from base64url
const publicKeyBytes = Uint8Array.from(atob(jwk.x.replace(/-/g, '+').replace(/_/g, '/')), c => c.charCodeAt(0))
const publicKeyBytes = base64urlDecode(jwk.x)
// Import as Ed25519 public key
const key = await crypto.subtle.importKey(