| @@ -146,9 +146,12 @@ | ||
| 146 | 146 | $padding = 4 - $remainder; |
| 147 | 147 | $input .= str_repeat('=', $padding); |
| 148 | 148 | } |
| 149 | 149 | |
| 150 | - return base64_decode(strtr($input, '-_', '+/')); | |
| 150 | + // JWT segments use base64url encoding, so translate to standard Base64 before decoding. | |
| 151 | + $decoded = base64_decode(strtr($input, '-_', '+/'), true); | |
| 152 | + | |
| 153 | + return false === $decoded ? '' : $decoded; | |
| 151 | 154 | } |
| 152 | 155 | |
| 153 | 156 | /** |
| 154 | 157 | * JSON Encode without escape characters |