{"record":{"id":"8c3dcc734bf978b5","repo":"Pumpkin-MC/Pumpkin","slug":"base64-decoding-failed-0","errorCode":null,"errorMessage":"Base64 decoding failed: {0}","messagePattern":"Base64 decoding failed: (.+?)","errorType":"error_code","errorClass":"AuthError","httpStatus":null,"severity":"error","filePath":"crates/pumpkin-auth/src/jwt/mod.rs","lineNumber":39,"sourceCode":"    /// The player's display name (in-game name).\n    pub display_name: String,\n    /// The player's unique identifier (UUID).\n    pub uuid: String,\n    /// The player's Xbox User ID (XUID).\n    pub xuid: String,\n}\n\n/// Represents the possible errors that can occur during JWT verification.\n#[derive(Debug, Error)]\npub enum AuthError {\n    /// Indicates that a JWT token has an invalid format (not enough parts).\n    #[error(\"Invalid token format\")]\n    InvalidTokenFormat,\n    /// Indicates that the 'x5u' (X.509 URL) header parameter is missing from a token.\n    #[error(\"x5u not found in header\")]\n    MissingX5U,\n    /// Indicates a failure in Base64 decoding.\n    #[error(\"Base64 decoding failed: {0}\")]\n    Base64Decode(#[from] base64::DecodeError),\n    /// Indicates a failure in parsing JSON data.\n    #[error(\"JSON parse error: {0}\")]\n    JsonParse(#[from] serde_json::Error),\n    /// Indicates a failure in building a public key from its representation.\n    #[error(\"Public key build failed: {0}\")]\n    PublicKeyBuild(String),\n    /// Indicates that the token was not signed by the trusted Mojang public key.\n    #[error(\"Token not signed by trusted Mojang key\")]\n    MojangKeyMismatch,\n    /// Indicates that the token's signature is invalid.\n    #[error(\"Invalid signature\")]\n    InvalidSignature,\n    /// Indicates an error related to ECDSA signature operations.\n    #[error(\"ECDSA signature error: {0}\")]\n    Ecdsa(#[from] ecdsa::Error),\n}\n","sourceCodeStart":21,"sourceCodeEnd":57,"githubUrl":"https://github.com/Pumpkin-MC/Pumpkin/blob/8d4639e25a57c15e47448ec327c780d41bbf2356/crates/pumpkin-auth/src/jwt/mod.rs#L21-L57","documentation":"AuthError::Base64Decode, a wrapped base64::DecodeError (via #[from]) thrown when a JWT part (header, payload, or signature) cannot be Base64-decoded. JWT segments use base64url encoding; malformed characters or standard-base64 padding issues cause this error.","triggerScenarios":"Verifying a JWT where any dot-separated segment is not valid base64url — wrong alphabet, missing/incorrect padding handling, binary corruption, or passing a plain-text string as a token.","commonSituations":"Token stored/retrieved through a system that mangles it (URL encoding, line wrapping, JSON escaping); client uses standard base64 instead of base64url; truncation by fixed-size buffers or logs copy-paste.","solutions":["Ensure token segments use base64url (URL_SAFE) decoding, not standard base64, on both ends","Inspect the raw token for URL-encoded characters (%3D, %2B), whitespace, or line breaks and clean them","Verify the token isn't truncated by transport (headers size limits, database column length)","Regenerate a fresh token from the login flow to rule out corruption in storage"],"exampleFix":"// before\nbase64::engine::general_purpose::STANDARD.decode(part)?; // fails on '-'/'_'\n// after\nuse base64::Engine;\nbase64::engine::general_purpose::URL_SAFE_NO_PAD.decode(part)?;","handlingStrategy":"validation","validationCode":"const B64URL: base64::engine::GeneralPurpose = base64::engine::general_purpose::URL_SAFE_NO_PAD;\nfor part in token.split('.') {\n    if B64URL.decode(part).is_err() { return Err(\"token segment is not valid base64url\"); }\n}","typeGuard":"fn token_segments_decode(token: &str) -> bool {\n    use base64::Engine;\n    token.split('.').all(|p| base64::engine::general_purpose::URL_SAFE_NO_PAD.decode(p).is_ok())\n}","tryCatchPattern":"match jwt::verify(token) {\n    Err(AuthError::Base64Decode(e)) => { log::warn!(\"token base64 corrupt: {e}; check transport\"); reject_handshake(); }\n    Ok(claims) => { /* proceed */ }\n    Err(e) => return Err(e.into()),\n}","preventionTips":["Use URL_SAFE (base64url) decoding for JWT segments, not STANDARD","Strip URL-encoding and whitespace from tokens received via query params/headers","Check storage/transport limits (header size, column length) that could truncate tokens"],"tags":["rust","jwt","base64","decoding"],"backgroundTag":"base64-decode-failed","analyzedSha":"8d4639e25a57c15e47448ec327c780d41bbf2356","analyzedAt":"2026-09-09T15:32:22.916Z","contentChangedAt":"2026-09-09T15:32:22.916Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}