{"action":"created","issue":{"url":"https://api.github.com/repos/a-sit-plus/at-registrierkassen-mustercode/issues/634","repository_url":"https://api.github.com/repos/a-sit-plus/at-registrierkassen-mustercode","labels_url":"https://api.github.com/repos/a-sit-plus/at-registrierkassen-mustercode/issues/634/labels{/name}","comments_url":"https://api.github.com/repos/a-sit-plus/at-registrierkassen-mustercode/issues/634/comments","events_url":"https://api.github.com/repos/a-sit-plus/at-registrierkassen-mustercode/issues/634/events","html_url":"https://github.com/a-sit-plus/at-registrierkassen-mustercode/issues/634","id":266093790,"number":634,"title":"invalid verification of signatures","user":{"login":"jakubzytka","id":9912906,"avatar_url":"https://avatars1.githubusercontent.com/u/9912906?v=4","gravatar_id":"","url":"https://api.github.com/users/jakubzytka","html_url":"https://github.com/jakubzytka","followers_url":"https://api.github.com/users/jakubzytka/followers","following_url":"https://api.github.com/users/jakubzytka/following{/other_user}","gists_url":"https://api.github.com/users/jakubzytka/gists{/gist_id}","starred_url":"https://api.github.com/users/jakubzytka/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jakubzytka/subscriptions","organizations_url":"https://api.github.com/users/jakubzytka/orgs","repos_url":"https://api.github.com/users/jakubzytka/repos","events_url":"https://api.github.com/users/jakubzytka/events{/privacy}","received_events_url":"https://api.github.com/users/jakubzytka/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2017-10-17T11:46:49Z","updated_at":"2017-10-19T10:46:14Z","closed_at":null,"author_association":"NONE","body":"Signature verification in the verification tool (regkassen-demo-1.0.0.zip) is invalid.\r\n\r\nInstead of just verifying provided signature against provided JOSE header and JWS Payload it performs base64url decoding and reencoding of the JWS Payload during the process.\r\n\r\nAs it is not true that `base64urlEncode(base64urlDecode(data)) == data` the tool is verifying *different* data than provided, which results in failed signature verification.\r\n\r\nIn particular, apache commons library used for base64 operations in the verification tool strips padding after base64url-encoding data.\r\nSuch behavior is not required by https://tools.ietf.org/html/rfc4648\r\nAs a result, any JWS Payload which contains padding will not be accepted by the verification tool."},"comment":{"url":"https://api.github.com/repos/a-sit-plus/at-registrierkassen-mustercode/issues/comments/337871030","html_url":"https://github.com/a-sit-plus/at-registrierkassen-mustercode/issues/634#issuecomment-337871030","issue_url":"https://api.github.com/repos/a-sit-plus/at-registrierkassen-mustercode/issues/634","id":337871030,"user":{"login":"ztp-mino","id":25907670,"avatar_url":"https://avatars0.githubusercontent.com/u/25907670?v=4","gravatar_id":"","url":"https://api.github.com/users/ztp-mino","html_url":"https://github.com/ztp-mino","followers_url":"https://api.github.com/users/ztp-mino/followers","following_url":"https://api.github.com/users/ztp-mino/following{/other_user}","gists_url":"https://api.github.com/users/ztp-mino/gists{/gist_id}","starred_url":"https://api.github.com/users/ztp-mino/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ztp-mino/subscriptions","organizations_url":"https://api.github.com/users/ztp-mino/orgs","repos_url":"https://api.github.com/users/ztp-mino/repos","events_url":"https://api.github.com/users/ztp-mino/events{/privacy}","received_events_url":"https://api.github.com/users/ztp-mino/received_events","type":"User","site_admin":false},"created_at":"2017-10-19T10:46:14Z","updated_at":"2017-10-19T10:46:14Z","author_association":"NONE","body":"see the actual JWS standard: https://tools.ietf.org/html/rfc7515, section 2 \"Base64url Encoding\"\r\n\r\nit explicitly states that no padding is to be used in the JWS payload"}}
{"actor":{"display_login":"ztp-mino"}}