paulononato/backstage
1
0
Fork 0
Code Issues Pull Requests Actions 44 Packages Projects Releases Wiki Activity

fix(core-components): decode url-safe base64 tokens in proxy sign-in

Browse Source 
The proxy-based sign-in page derived the session expiry from the JWT by
decoding its payload with `window.atob`, which only accepts the standard
base64 alphabet. JWTs are encoded using base64url (RFC 7515), so any
token whose payload contained '-' or '_' raised a decoding error and
broke sign-in. Translate the payload back to the standard alphabet and
restore its padding before decoding.

Signed-off-by: Asish Kumar <officialasishkumar@gmail.com>
This commit is contained in:
Asish Kumar
2026-05-25 03:30:23 +05:30
parent 6fa1cacfbe
commit 8add9b992d
3 changed files with 37 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.changeset/proxied-signin-base64url-token.md
+5
View File
@@ -0,0 +1,5 @@
---
'@backstage/core-components': patch
---
Fixed the proxy-based sign-in page failing to read the session token when the proxy issues a token whose payload is encoded using the URL-safe base64 alphabet. Such tokens are now decoded correctly so sign-in no longer breaks.