From 89b14639a9f676f99dac127586e03a34fa8bf94e Mon Sep 17 00:00:00 2001 From: Aarushi Arya Date: Wed, 31 Oct 2018 15:07:20 -0700 Subject: [PATCH] avoid using URL encoding to generate keys (#6731) --- pkg/auth/credentials.go | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/pkg/auth/credentials.go b/pkg/auth/credentials.go index a9b8f1c93..5e4b5c867 100644 --- a/pkg/auth/credentials.go +++ b/pkg/auth/credentials.go @@ -21,6 +21,7 @@ import ( "crypto/subtle" "encoding/base64" "fmt" + "strings" "time" jwtgo "github.com/dgrijalva/jwt-go" @@ -131,7 +132,7 @@ func GetNewCredentialsWithMetadata(m map[string]interface{}, tokenSecret string) if err != nil { return cred, err } - cred.SecretKey = string([]byte(base64.URLEncoding.EncodeToString(keyBytes))[:secretKeyMaxLen]) + cred.SecretKey = strings.Replace(string([]byte(base64.StdEncoding.EncodeToString(keyBytes))[:secretKeyMaxLen]), "/", "+", -1) cred.Status = "enabled" expiry, ok := m["exp"].(float64)