HttpServerUtility.UrlTokenDecode fails "sometimes" (Invalid length for a Base-64 char array.)

Question

We have an IHttpHandler for stylesheets and add a <link/> tag to the page like this:

HtmlGenericControl link = new HtmlGenericControl("link");
link.Attributes.Add("rel", "stylesheet");
link.Attributes.Add("href", "stylesheet.axd?d=" +
                                    HttpServerUtility.UrlTokenEncode(token));
head.Controls.Add(link);

In the stylesheet.axd handler, we UrlTokenDecode the d query string parameter like this:

var token = HttpServerUtility.UrlTokenDecode(Request.QueryString["d"]);

This works most of the time but every now and then we find one of the following two exceptions in our log:

[FormatException: Invalid character in a Base-64 string.]
   System.Convert.FromBase64CharArray(Char[] inArray, Int32 offset, Int32 length)
   System.Web.HttpServerUtility.UrlTokenDecode(String input)
   ...

[FormatException: Invalid length for a Base-64 char array.]
   System.Convert.FromBase64CharArray(Char[] inArray, Int32 offset, Int32 length)
   System.Web.HttpServerUtility.UrlTokenDecode(String input)
   System.Web.HttpServerUtilityWrapper.UrlTokenDecode(String input)
   ...

Any ideas what would cause this phenomenon?

Remarks:

the resulting URL is < 1500, so below any known URL limits (e.g. IE: 2083)
seems to be independent of user agent (we have these exceptions for IE6,7,8, FF & Chrome)
our (unconfirmed) suspicions include AntiVirus products, HTTP proxies, browser addons
found this remotely related question, but it's about a viewstate issue

did you get cause of this phenomenon? `FromBase64String` ? – Kiquenet Jul 14 '16 at 10:34 — Kiquenet, Jul 14 '16 at 10:34

score 0 · Answer 1 · answered Sep 08 '09 at 09:45

We had similar problems, so we avoided UrlTokenEncode, the reason is base64 sometimes pads trailing characters as '==' and so on, so they dont get transmitted in url correctly. And I think there is a bug in .NET, however we changed it to following and it started working.

We did this way and it worked always.

url += "&d=" + HttpServerUtility.UrlEncode( Convert.ToBase64String( ... ))

and at receiving side, we use only

data = Convert.FromBase64String( Request.QueryString["d"] )

We do not need to use UrlDecode, because the query string object stores information in decoded format already.

Don't build URLs or query strings using string formatting! It is so easy and so common to forget encoding, or doing it wrong, or adding multiple `?` instead of `&`, etc. Use the following solution for building query strings: https://stackoverflow.com/a/1877016/2279059 Use `UriBuilder` for adding query strings to URLs. — Florian Winter, Jul 12 '18 at 08:28

score 0 · Answer 2 · answered Jul 12 '18 at 08:30

0

UrlTokenDecode and UrlTokenEncode do not actually decode/encode base64url, but can be used for it anyway with some additions. Also, there are alternatives which may or may not be better.

See C#: base64url according to RFC4648

answered Jul 12 '18 at 08:30

Florian Winter

4,750
1
44
69

HttpServerUtility.UrlTokenDecode fails "sometimes" (Invalid length for a Base-64 char array.)

2 Answers2

Linked