Skip to content
This repository was archived by the owner on May 12, 2026. It is now read-only.

Commit 8a75ccd

Browse files
huangjiahuahuangjiahua
authored
fix: Do not add padding in Client-Side CAB tokens. (#1728)
* fix: Do not add padding in Client-Side CAB tokens. Change-Id: I1dc0dfeb7e29e902ad3442cae28d10383816f58b * Add unit test assertions to verify the generated token has no padding. Change-Id: I7b948a13a075d7afeac19f96b9372f23b60d4eda * Add comment to explain why padding is removed. Change-Id: I0882e0c5d99310b179ace493b937669520626263 * Run mvn format. Change-Id: I8e3c59c42fceeaf593fa08e85b40754d57e71a45
1 parent dbd03aa commit 8a75ccd

2 files changed

Lines changed: 16 additions & 1 deletion

File tree

‎cab-token-generator/java/com/google/auth/credentialaccessboundary/ClientSideCredentialAccessBoundaryFactory.java‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -206,8 +206,13 @@ public AccessToken generateToken(CredentialAccessBoundary accessBoundary)
206206

207207
byte[] encryptedRestrictions = this.encryptRestrictions(rawRestrictions, sessionKey);
208208

209+
// withoutPadding() is used to stay consistent with server-side CAB
210+
// withoutPadding() avoids additional URL encoded token issues (i.e. extra equal signs `=` in
211+
// the path)
209212
String tokenValue =
210-
intermediateToken + "." + Base64.getUrlEncoder().encodeToString(encryptedRestrictions);
213+
intermediateToken
214+
+ "."
215+
+ Base64.getUrlEncoder().withoutPadding().encodeToString(encryptedRestrictions);
211216

212217
return new AccessToken(tokenValue, intermediateTokenExpirationTime);
213218
}

‎cab-token-generator/javatests/com/google/auth/credentialaccessboundary/ClientSideCredentialAccessBoundaryFactoryTest.java‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -744,6 +744,11 @@ public void generateToken_withAvailablityCondition_success() throws Exception {
744744
CabToken cabToken = parseCabToken(token);
745745
assertEquals("accessToken", cabToken.intermediateToken);
746746

747+
// Base64 encoding output by default has `=` padding at the end if the input length
748+
// is not a multiple of 3. Here we verify the use of `withoutPadding` that removes
749+
// this padding.
750+
assertFalse(cabToken.encryptedRestriction.contains(String.valueOf("=")));
751+
747752
// Checks the encrypted restriction is the correct proto format of the CredentialAccessBoundary.
748753
ClientSideAccessBoundary clientSideAccessBoundary =
749754
decryptRestriction(
@@ -794,6 +799,11 @@ public void generateToken_withoutAvailabilityCondition_success() throws Exceptio
794799
CabToken cabToken = parseCabToken(token);
795800
assertEquals("accessToken", cabToken.intermediateToken);
796801

802+
// Base64 encoding output by default has `=` padding at the end if the input length
803+
// is not a multiple of 3. Here we verify the use of `withoutPadding` that removes
804+
// this padding.
805+
assertFalse(cabToken.encryptedRestriction.contains(String.valueOf("=")));
806+
797807
// Checks the encrypted restriction is the correct proto format of the CredentialAccessBoundary.
798808
ClientSideAccessBoundary clientSideAccessBoundary =
799809
decryptRestriction(

0 commit comments

Comments
 (0)