Race condition in repackaged Base64 breaks auths at random about java-jwt

[lehoule]

+1 this project is unuseable for me without this fix.

[dhenry-fa]

Hi,

I ran into the same issue and had a hard time figuring out the race condition too. I worked around it by creating a new instance of a JWTVerifier every time I need to check a token instead of reusing one single instance. It must be quite CPU intensive but it's the best I could manage…

This pull request might be the solution but no progress has been made for about one year: #30

[neg3ntropy]

commons codec is repackaged that's fine with me. But the version is way too old:
https://issues.apache.org/jira/browse/CODEC-96

[neg3ntropy]

Also, what has really took me for a ride before finding this bug, is that commons-codec is also a transitive maven dependency and in my project it was already resolved to a later version, thus I initially excluded the above upstream bug as a possible cause.
In fact you end up with 2 commons-codecs and using the buggy one.

[adrogon]

@hzalaz @arcseldon Any input on this subject?
The preferred solution would be to get rid of commons-codec entirely (like discussed in #30), but at least an upgrade of the dependency in the meantime would be welcome.
It shouldn't take too long to review #71 :) Thank you.

[adrogon]

Pinging. This project needs to be maintained, and here is a quick fix to a major issue that is already provided by the community.
All you have to do is accept the pull request and bump the version, please help, thank you :)

[lebels]

We need this fix too. Please accept the pull request.

[adrogon]

Hello hello,

Please upgrade to latest commons-codec, there's a nice PR #71 for you to accept, and everyone will feel more comfortable.

Thanks in advance maintainers.

[neg3ntropy]

We solved by building this manually and pushing to a local artifactory with a custom version suffix.

You've got here now an absolute proof of the bug and fix. I have been running this for while, it's really ok to merge. I here dare you to close this ASAP and show a sign to the community.

In the meantime other potential users beware: this version will work only in your local machine by yourself. In the real world it will randomly refuse auths and you will end up thinking it is some other bug or misconfiguration.
In case you use some particular apache commons in your project as well, it might even break your builds.
It's BAD.

Cheers

[adrogon]

Thank you @hzalaz