EPA-156: Remove padding from code_verifier (#103)

oviva-ag · Oct 16, 2024 · 40a7b78 · 40a7b78
1 parent 6d83386
commit 40a7b78
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 2 deletions.
diff --git a/ehealthid-rp/src/main/java/com/oviva/ehealthid/relyingparty/svc/AuthService.java b/ehealthid-rp/src/main/java/com/oviva/ehealthid/relyingparty/svc/AuthService.java
@@ -59,9 +59,10 @@ private static String calculateS256CodeChallenge(String codeVerifier) {
   private static String generatePkceCodeVerifier() {
     var rng = new SecureRandom();
 
+    // https://datatracker.ietf.org/doc/html/rfc7636#section-4.1
     var bytes = new byte[32];
     rng.nextBytes(bytes);
-    return Base64.getUrlEncoder().encodeToString(bytes);
+    return Base64.getUrlEncoder().withoutPadding().encodeToString(bytes);
   }
 
   // Authorization Request

diff --git a/ehealthid/src/test/java/com/oviva/ehealthid/auth/AuthenticationFlowExampleTest.java b/ehealthid/src/test/java/com/oviva/ehealthid/auth/AuthenticationFlowExampleTest.java
@@ -175,6 +175,6 @@ private String generateCodeVerifier() {
 
     var bytes = new byte[32];
     rng.nextBytes(bytes);
-    return Base64.getUrlEncoder().encodeToString(bytes);
+    return Base64.getUrlEncoder().withoutPadding().encodeToString(bytes);
   }
 }