Use a different base64 decoder

Oct 13, 2025 by pinkandtrash.com 10 views

Bug: 'Illegal base64 character 2d' occurs when decoding token values in TokenRequestExecutor.createAuthenticationResultFromOauthHttpResponse for specific accounts

Introduction

Microsoft Authentication Library for Java (MSAL4J) is a popular library used for authentication and authorization in Java applications. However, users have reported a bug in the latest version of MSAL4J (1.19.1) where the error 'java.lang.IllegalArgumentException: Illegal base64 character 2d' occurs when decoding token values in TokenRequestExecutor.createAuthenticationResultFromOauthHttpResponse for specific accounts. In this article, we will delve into the details of this bug, its impact, and potential solutions.

Library Version Used

The bug was reported in MSAL4J version 1.19.1. It is essential to note that this bug does not occur in the previous version, 1.18.0, which uses Base64.getUrlEncoder().

Java Version

The bug was reported in Java version 1.8. However, it is likely that this bug can occur in other versions of Java as well.

Scenario

The bug occurs in the ConfidentialClient scenario, specifically when using the AcquireTokenByAuthCode method.

Is This a New or an Existing App?

This bug is not related to a specific app, but rather a library issue.

Issue Description and Reproduction Steps

The error 'java.lang.IllegalArgumentException: Illegal base64 character 2d' occurs when decoding token values in TokenRequestExecutor.createAuthenticationResultFromOauthHttpResponse. The error location is in the following code snippet:

class TokenRequestExecutor {
...
  private AuthenticationResult createAuthenticationResultFromOauthHttpResponse(HTTPResponse oauthHttpResponse) throws ParseException {
  ...
  idTokenJson = new String(Base64.getDecoder().decode(tokens.getIDTokenString().split("\\.")[1]), StandardCharsets.UTF_8);
  ...
  }
}

The error occurs when the getIDTokenString() method returns a string containing the character '2d', which is not a valid base64 character.

Relevant Code Snippets

// TokenRequestExecutor.java
public class TokenRequestExecutor {
  ...
  private AuthenticationResult createAuthenticationResultFromOauthHttpResponse(HTTPResponse oauthHttpResponse) throws ParseException {
  ...
  idTokenJson = new String(Base64.getDecoder().decode(tokens.getIDTokenString().split("\\.")[1]), StandardCharsets.UTF_8);
  ...
  }
  ...
}

// HTTPResponse.java
public class HTTPResponse {
  ...
  public String getIDTokenString() {
    return "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c";
  }
  ...
}

Expected Behavior

The expected behavior is that the createAuthenticationResultFromOauthHttpResponse method should return an AuthenticationResult object without throwing an exception.

Identity Provider

The identity provider affected by this bug is Microsoft Entra ID, which includes Work and School accounts and Personal Microsoft accounts.

Regression

There is no regression information available for this bug.

Solution and Workarounds

Unfortunately, there is no solution or workaround available for this bug at this time. However, we can provide some potential solutions and workarounds:

Downgrade to MSAL4J version 1.18.0: If possible, downgrade to MSAL4J version 1.18.0, which uses Base64.getUrlEncoder() and does not exhibit this bug.
Use a different base64 decoder: Consider using a different base64 decoder, such as Base64.getUrlEncoder(), which may not throw an exception for invalid base64 characters.
Custom implementation: Implement a custom TokenRequestExecutor class that handles base64 decoding differently, such as ignoring invalid characters or using a different decoding algorithm.

Conclusion

The bug 'Illegal base64 character 2d' occurs when decoding token values in TokenRequestExecutor.createAuthenticationResultFromOauthHttpResponse for specific accounts in MSAL4J version 1.19.1. This bug is likely due to the use of Base64.getDecoder() instead of Base64.getUrlEncoder(). We have provided some potential solutions and workarounds, but a definitive solution is still pending. We recommend downgrading to MSAL4J version 1.18.0 or using a different base64 decoder until a fix is available.
Bug: 'Illegal base64 character 2d' occurs when decoding token values in TokenRequestExecutor.createAuthenticationResultFromOauthHttpResponse for specific accounts

Q&A

Q: What is the bug 'Illegal base64 character 2d' in MSAL4J?

A: The bug 'Illegal base64 character 2d' occurs when decoding token values in TokenRequestExecutor.createAuthenticationResultFromOauthHttpResponse for specific accounts in MSAL4J version 1.19.1. This bug is likely due to the use of Base64.getDecoder() instead of Base64.getUrlEncoder().

Q: What is the impact of this bug?

A: The impact of this bug is that it throws an exception when decoding token values in TokenRequestExecutor.createAuthenticationResultFromOauthHttpResponse, which can cause authentication and authorization issues in Java applications using MSAL4J.

Q: Which versions of MSAL4J are affected by this bug?

A: The bug is reported in MSAL4J version 1.19.1. However, it is likely that this bug can occur in other versions of MSAL4J as well.

Q: Which Java versions are affected by this bug?

A: The bug is reported in Java version 1.8. However, it is likely that this bug can occur in other versions of Java as well.

Q: What is the expected behavior of createAuthenticationResultFromOauthHttpResponse?

A: The expected behavior of createAuthenticationResultFromOauthHttpResponse is that it should return an AuthenticationResult object without throwing an exception.

Q: Which identity providers are affected by this bug?

A: The identity provider affected by this bug is Microsoft Entra ID, which includes Work and School accounts and Personal Microsoft accounts.

Q: Are there any workarounds or solutions available for this bug?

A: Unfortunately, there is no solution or workaround available for this bug at this time. However, we can provide some potential solutions and workarounds:

Downgrade to MSAL4J version 1.18.0: If possible, downgrade to MSAL4J version 1.18.0, which uses Base64.getUrlEncoder() and does not exhibit this bug.
Use a different base64 decoder: Consider using a different base64 decoder, such as Base64.getUrlEncoder(), which may not throw an exception for invalid base64 characters.
Custom implementation: Implement a custom TokenRequestExecutor class that handles base64 decoding differently, such as ignoring invalid characters or using a different decoding algorithm.

Q: How can I report this bug to Microsoft?

A: If you are experiencing this bug, you can report it to Microsoft by submitting a bug report through the Microsoft Support website or by contacting Microsoft support directly.

Q: Is this bug a security vulnerability?

A: The bug 'Illegal base64 character 2d' is not a security vulnerability in the classical sense. However, it can cause authentication and authorization issues in Java applications using MSAL4J, which can potentially lead to security issues if not addressed.

Q: Will Microsoft fix this bug?

A: Microsoft has not yet confirmed whether they will fix this bug. However, we recommend keeping an eye on the MSAL4J GitHub repository and Microsoft Support website for any updates or patches related to this bug.