using a base64 encoded string in url with codeigniter

Question

I have an encrypted, base64 encoded array that I need to put into a url and insert into emails we send to clients to enable them to be identified (uniquely) - the problem is that base64_encode() often appends an = symbol or two after it's string of characters, which by default is disallowed by CI.

Here's an example: http://example.com/cec/pay_invoice/VXpkUmJnMWxYRFZWTEZSd0RXZFRaMVZnQWowR2N3TTdEVzRDZGdCbkQycFFaZ0JpQmd4V09RRmdWbkVMYXdZbUJ6OEdZQVJ1QlNJTU9Bb3RWenNFSmxaaFVXcFZaMXQxQXpWV1BRQThVVEpUT0ZFZ0RRbGNabFV6VkNFTlpsTWxWV29DTmdackEzQU5Nd0lpQURNUGNGQS9BRFlHWTFacUFTWldOZ3M5QmpRSGJBWTlCREVGWkF4V0NtQlhiZ1IzVm1CUk9sVm5XMllEWlZaaEFHeFJZMU51VVdNTmJsdzNWVzlVT0EwZw==

Now I understand I can allow the = sign in config.php, but I don't fully understand the security implications in doing so (it must have been disabled for a reason right?)

Does anyone know why it might be a bad idea to allow the = symbol in URLs?

Thanks! John.

CI doensn't allow '=' if you use segments. If you enable query strings, '=' will be perfectly legal (of course) — Damien Pirsy
– Damien Pirsy, Commented Jul 1, 2011 at 5:25

Matthew Scharley · Accepted Answer · 2011-07-02 08:58:47Z

19

Not sure why = is disallowed, but you could also leave off the equals signs.

$base_64 = base64_encode($data);
$url_param = rtrim($base_64, '=');
// and later:
$base_64 = $url_param . str_repeat('=', strlen($url_param) % 4);
$data = base64_decode($base_64);

The base64 spec only allows = signs at the end of the string, and they are used purely as padding, there is no chance of data loss.

Edit: It's possible that it doesn't allow this as a compatibility option. There's no reason that I can think of from a security perspective, but there's a possibility that it may mess with query string parsing somewhere in the tool chain.

edited Jul 2, 2011 at 8:58

answered Jul 1, 2011 at 3:53

Matthew Scharley

133k55 gold badges199 silver badges225 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Ali Raza · Accepted Answer · 2014-12-09 11:19:13Z

3

Please add the character "=" to $config['permitted_uri_chars'] in your config.php file you can find that file at application/config folder

answered Dec 9, 2014 at 11:19

Ali Raza

18314 bronze badges

Comments

zerkms · Accepted Answer · 2011-07-01 03:51:29Z

2

Originally there are no any harmful characters in the url at all. But there are not experienced developers or bad-written software that helps some characters to become evil.

As of = - I don't see any issues with using it in urls

answered Jul 1, 2011 at 3:51

zerkms

256k73 gold badges447 silver badges551 bronze badges

Comments

hari_om · Accepted Answer · 2014-12-26 18:16:00Z

1

Instead of updating config file you can use urlencode and urldecode function of native php.

$str=base64_encode('test');
$url_to_be_send=urlencode($str);
//send it via url

//now on reciveing side

//assuming value passed via get is stored in $encoded_str

$decoded_str=base64_decode(urldecode($encoded_str));

answered Dec 26, 2014 at 18:16

hari_om

4211 gold badge4 silver badges6 bronze badges

Collectives™ on Stack Overflow

using a base64 encoded string in url with codeigniter

4 Answers 4

Comments

Comments

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

4 Answers 4

Comments

Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related