Add in information about base64 encoding for JWTs about auth-boss

[teesloane]

I'm not super familiar with Auth0 so I might need a hand here. I'm also referencing jwt's section on signature (about half way down the page).

So I'm guessing instead of just a secret that is a garbled string (ie dfjjf3209adlkjlj02$F) -- Auth0 base64 encodes the secret they sign tokens with ... and I suppose JWT libraries default to expecting ... not base64?

Is this something that would be common only really to Auth0?

If I'm on the right track - let me know if you think this is a good addendum:

In the case that your token's secret is base64 encoded you will need to make sure you decode it prior to passing it into your jwt verification function.

[rohannair]

It's not about Auth0 as much as it is recommended to encode the client secret. It's another measure of security to obscure the client secret.

[raylu]

Obscurity is not security.

The encoding is so that it can be passed safely in HTTP headers, which have all sorts of very special parsing rules, especially regarding commas: https://tools.ietf.org/html/rfc7230#section-3.2.2

The base64 encoding is a trivial implementation detail and not necessarily worth going into here. It doesn't affect the design and isn't a factor when considering which auth mechanism to use.

[teesloane]

Thanks for the input folks.

In this case, I've decided to add a snippet discussing the possibility of needing to decode a base64 secret key prior to decoding the token itself.