Skip to content

fix: Replace java.util.Base64 with android.util.Base64 for backwards compatibility #20

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
RickyJam wants to merge 2 commits into from
Closed

fix: Replace java.util.Base64 with android.util.Base64 for backwards compatibility #20

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
5ed92c5
refactor: removed unused import
riccardopacifico-max Feb 17, 2026
1660f2b
fix: replaced java.util.base64 with android.util.base64 for backwad c…
riccardopacifico-max Feb 17, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 3 additions & 6 deletions android/src/main/java/com/googleauth/GoogleAuthModule.kt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,6 @@
package com.googleauth

import android.app.Activity
import android.content.Context
import android.content.SharedPreferences
import android.util.Log
import androidx.lifecycle.Lifecycle
Expand Down Expand Up @@ -32,10 +31,8 @@ import kotlinx.coroutines.Dispatchers
import kotlinx.coroutines.delay
import kotlinx.coroutines.launch
import kotlinx.coroutines.withContext
import java.util.Date
import java.util.concurrent.TimeUnit
import org.json.JSONObject
import java.util.Base64
import android.util.Base64

@ReactModule(name = GoogleAuthModule.NAME)
class GoogleAuthModule(reactContext: ReactApplicationContext) :
Expand Down Expand Up @@ -867,7 +864,7 @@ class GoogleAuthModule(reactContext: ReactApplicationContext) :
try {
val parts = idToken.split(".")
if (parts.size >= 2) {
val payload = String(Base64.getUrlDecoder().decode(parts[1]))
val payload = String(Base64.decode(parts[1], Base64.NO_WRAP))

@coderabbitai coderabbitai Bot Feb 17, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

Bug: Base64.NO_WRAP does not handle URL-safe Base64 — JWT payloads use base64url encoding.

JWTs encode their payload using base64url (RFC 7515), which substitutes + → - and / → _. The previous code correctly used java.util.Base64.getUrlDecoder(). Replacing it with android.util.Base64.decode(..., Base64.NO_WRAP) uses the standard alphabet and will silently produce corrupted output (or throw) whenever the payload contains - or _ characters.

Use Base64.URL_SAFE (which also implies no wrap/padding handling) instead:

Proposed fix 
-        val payload = String(Base64.decode(parts[1], Base64.NO_WRAP))
+        val payload = String(Base64.decode(parts[1], Base64.URL_SAFE))
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
val payload = String(Base64.decode(parts[1], Base64.NO_WRAP))
val payload = String(Base64.decode(parts[1], Base64.URL_SAFE))
🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@android/src/main/java/com/googleauth/GoogleAuthModule.kt` at line 867, The
JWT payload decoding in GoogleAuthModule (the line creating the payload variable
from parts[1]) uses android.util.Base64.decode with Base64.NO_WRAP which is
incorrect for base64url JWTs; update the Base64.decode call to use
Base64.URL_SAFE (e.g., replace Base64.NO_WRAP with Base64.URL_SAFE) or switch to
java.util.Base64.getUrlDecoder().decode(parts[1]) so the URL-safe alphabet is
handled correctly and padding/unwrap issues are avoided.

val json = JSONObject(payload)
val exp = json.optLong("exp", 0)
if (exp > 0) {
Expand All @@ -883,7 +880,7 @@ class GoogleAuthModule(reactContext: ReactApplicationContext) :
try {
val parts = idToken.split(".")
if (parts.size >= 2) {
val payload = String(Base64.getUrlDecoder().decode(parts[1]))
val payload = String(Base64.decode(parts[1], Base64.NO_WRAP))

@coderabbitai coderabbitai Bot Feb 17, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

Same base64url bug as parseTokenExpiration — use Base64.URL_SAFE here too.

Proposed fix 
-        val payload = String(Base64.decode(parts[1], Base64.URL_SAFE))
+        val payload = String(Base64.decode(parts[1], Base64.URL_SAFE))

(Ensure this line reads Base64.URL_SAFE instead of Base64.NO_WRAP.)

-        val payload = String(Base64.decode(parts[1], Base64.NO_WRAP))
+        val payload = String(Base64.decode(parts[1], Base64.URL_SAFE))
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
val payload = String(Base64.decode(parts[1], Base64.NO_WRAP))
val payload = String(Base64.decode(parts[1], Base64.URL_SAFE))
🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@android/src/main/java/com/googleauth/GoogleAuthModule.kt` at line 883, The
Base64 decoding here uses Base64.NO_WRAP which fails for base64url JWT payloads;
update the decode call in GoogleAuthModule.kt (the line building payload from
parts[1]) to use Base64.URL_SAFE instead of Base64.NO_WRAP, matching the fix
used in parseTokenExpiration so JWTs encoded with URL-safe base64 decode
correctly.

val json = JSONObject(payload)
return json.optString("email", null)
}
Expand Down
Loading