Improper handling of the base64-encoded signing key
- Dominant language
- No language data
- Stars
- 88
- Forks
- 88
- PR merge metrics
- No merged PRs in 30d
Description
# Description
Hybrid Connections generate signing keys that are base64 encoded, but then expect the client to grab that base64-encoded string, take the underlying bytes and sign the token with that.
Here's an example of a client that probably works, but is wrong: https://github.com/Azure/azure-relay-dotnet/blob/dev/src/Microsoft.Azure.Relay/Common/TokenProvider.cs#L16
A client that is implemented correctly and first decodes the base64-encoded key fails to authenticate.
I'm no cryptographer, but could this have some impact on the strength of your security?
Here's Azure documentation stating that the keys are base64-encoded: https://docs.microsoft.com/en-us/azure/service-bus-messaging/service-bus-sas#overview-of-sas
## Actual Behavior
1. Send an HTTP request to a Hybrid Connection thingy, passing a token signed with a properly decoded base64 key.
2. Azure responds with an Invalid Signature error.
3. Send an HTTP request to a Hybrid Connection thingy, passing a token signed with the bytes of the base64-encoded string.
4. Authentication succeeds.
## Expected Behavior
The reverse of the actual behavior.
Contributor guide
Assessment
This issue has not been assessed yet.