Repository navigation
Base64 error since v10.0.2 #449
Description
Since updating to version 10.0.2, I can't send notifications to my subscribers. They fail with the following error. This is most likely a result of pull request #438, which replaced spomky-labs/base64url with web-token/jwt-library. It appears this change isn't backward compatible. Downgrading to 10.0.1 resolved the issue.
RangeException: Base64::decode() only expects characters in the correct base64 alphabet in /[...]/vendor/web-token/jwt-library/Core/Util/Base64UrlSafe.php:153
Stack trace:
#0 /[...]/vendor/minishlink/web-push/src/Encryption.php(79): Jose\Component\Core\Util\Base64UrlSafe::decode()
#1 /[...]/vendor/minishlink/web-push/src/Encryption.php(57): Minishlink\WebPush\Encryption::deterministicEncrypt()
#2 /[...]/vendor/minishlink/web-push/src/WebPush.php(252): Minishlink\WebPush\Encryption::encrypt()
#3 /[...]/vendor/minishlink/web-push/src/WebPush.php(148): Minishlink\WebPush\WebPush->prepare()
#4 [internal function]: Minishlink\WebPush\WebPush->flush()
#5 /[...]/vendor/minishlink/web-push/src/WebPush.php(118): Generator->current()
#6 /[...]/app/NotificationChannels/WebPush/WebPushChannel.php(29): Minishlink\WebPush\WebPush->sendOneNotification()
[...]
Activity
Minishlink commentedon Mar 9, 2026
Thanks I'll create a 10.0.3 with #438 reverted. Do you have some example data to reproduce? CI tests haven't caught this
maciek-szn commentedon Mar 9, 2026
Here is an example of a public key:
BK6rMrh6WSnA/V6XB8sarpxp3vQ2eTxUKsiexiS687c/JuxoUAMrupLKl0UMVx6OxptOnZ/CVEO6oLnHR5sAimg=There seems to be a problem with the
+,/,=characters.Minishlink commentedon Mar 9, 2026
Thanks for the example public key :)
10.0.3 is created (#450)
cc @Rotzbua
Rotzbua commentedon Mar 11, 2026
@maciek-szn Thanks for the example. Could you add the key in an additional test as PR?
maciek-szn commentedon Mar 11, 2026
@Rotzbua I'm sorry, but I don't really know how to do this. I'd be happy to learn if someone else prepares a PR.
Thinking deeper about the cause of the problems, I came to the conclusion that the source is the implementation of the
urlBase64ToUint8Arrayfunction, mentioned in the README. This is where the problematic+,/, and=characters appear. This implementation - incompatible withweb-token/jwt-library- probably exists in thousands of places around the web, as it's sample code demonstrating how to implement web push notifications.Rotzbua commentedon Mar 23, 2026
Good observation. That is the standard base64 encoding. The current push standard defines base64urlsafe as encoding. I guess older implementations and standards did use standard base64.
@maciek-szn Do you have information about the creation time of the subscription or used browser?
As solution for my newer implementation I think an automatic conversion to base64url should solve the problem.
maciek-szn commentedon Mar 23, 2026
I don't have precise data, but new subscriptions are created on an ongoing basis. They come from Chrome/Chromium (usually
https://fcm.googleapis.com/fcm/send/*), less often Firefox (https://updates.push.services.mozilla.com/wpush/v2/*), Edge (https://wns2-am3p.notify.windows.com/w/?token=*) and Safari (https://web.push.apple.com/*).