From 8d005b030fd73015e860ef04beb0709a04d07c65 Mon Sep 17 00:00:00 2001 From: Ruben Fiszel Date: Tue, 13 Jan 2026 19:47:31 +0000 Subject: [PATCH] fix(debugger): properly decode base64url public key from JWKS The public key decoding from JWKS was missing base64url padding, causing JWT signature verification to fail with "invalid jwt token" errors in production. The `jwk.x` value needs proper padding before base64 decoding. Fixed by using the existing `base64urlDecode` helper function which correctly adds padding, instead of manually doing the conversion. This resolves JWT verification failures when REQUIRE_SIGNED_DEBUG_REQUESTS is enabled. Co-Authored-By: Claude Opus 4.5 --- debugger/dap_debug_service.ts | 2 +- debugger/dap_websocket_server_bun.ts | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/debugger/dap_debug_service.ts b/debugger/dap_debug_service.ts index e9dcc68c3c..8f4294b5be 100644 --- a/debugger/dap_debug_service.ts +++ b/debugger/dap_debug_service.ts @@ -213,7 +213,7 @@ async function getPublicKey(): Promise { } // Decode the public key from base64url - const publicKeyBytes = Uint8Array.from(atob(jwk.x.replace(/-/g, '+').replace(/_/g, '/')), c => c.charCodeAt(0)) + const publicKeyBytes = base64urlDecode(jwk.x) // Import as Ed25519 public key const key = await crypto.subtle.importKey( diff --git a/debugger/dap_websocket_server_bun.ts b/debugger/dap_websocket_server_bun.ts index 8db0d853ce..5838be2bad 100644 --- a/debugger/dap_websocket_server_bun.ts +++ b/debugger/dap_websocket_server_bun.ts @@ -186,7 +186,7 @@ async function getPublicKey(): Promise { } // Decode the public key from base64url - const publicKeyBytes = Uint8Array.from(atob(jwk.x.replace(/-/g, '+').replace(/_/g, '/')), c => c.charCodeAt(0)) + const publicKeyBytes = base64urlDecode(jwk.x) // Import as Ed25519 public key const key = await crypto.subtle.importKey(