michaelrhanson/jwt-js — pull request #3 by jylauril (2013-01-17 22:18:24+00:00)
Title: Bug with base64urlencode string replacing

I had a weird error in my application that happened very rarely, but it bugged me enough to spend time solving it. I was hunting this bug for days until I finally found out that the problem occurred when the signature part of the serialized WebToken had more than one plus signs in it.

The current implementation of the `base64urlencode` is using a non-standard method for replacing "global" string occurrence, which doesn't seem to work with some of the modern browsers (ie. WebKit based). This resulted in a behavior that only the first occurrence of the plus sign got replaced to a dash, but not the rest. And when the end result was used in the URL, the plus signs got decoded into spaces and that's where the signature failed.

I changed the `base64urlencode` and `base64urldecode` to use a proper regular expression in the replace method, which has a more standard way of matching global patterns.