tree 5378898cad2b43d653c7e32f222505102e5fe042
parent 2807ae01c3c0b4886b2990e9e2b4d133f7fc5695
author David Ostrovsky <david@ostrovsky.org> 1770980818 +0100
committer David Ostrovsky <david@ostrovsky.org> 1770986626 +0100

Replace commons-codec Base64 with JDK Base64 for JWT decoding

JWT tokens encode their header and payload using Base64URL as defined by
RFC 7515/7519. The current implementation decodes JWT payloads using
either org.apache.commons.codec.binary.Base64 or the standard Base64
decoder, neither of which implements the URL-safe Base64 variant required
by the JWT specification. This may silently accept malformed input or
fail for URL-safe payloads.

Replace existing decoding logic with java.util.Base64.getUrlDecoder(),
which correctly implements Base64URL, and apply the same decoding to
SAP IAS JWT parsing, which previously used the standard Base64 decoder.

As part of this change:
  * Decode JWT payloads using Base64.getUrlDecoder()
  * Remove reliance on UnsupportedEncodingException by using
    StandardCharsets.UTF_8 directly
  * Maintain existing failure semantics for malformed JWT structure,
    while treating invalid Base64URL payloads as IO failures.

Malformed tokens that were previously accepted due to permissive
decoding will now be rejected.

Remove the commons-codec dependency from the oauth plugin entirely.

Change-Id: I033936936bdf88713e9eab604923215b0b57d4a7