Skip to content

Comments

Fix JWT Serialization#277

Merged
spruceduncan merged 3 commits intomainfrom
fix/jwt-serialization-fix
Feb 17, 2026
Merged

Fix JWT Serialization#277
spruceduncan merged 3 commits intomainfrom
fix/jwt-serialization-fix

Conversation

@spruceduncan
Copy link
Contributor

Summary

Fixes double-encoding of JWT credential payloads for jwt_vc_json and jwt_vc_json-ld formats in RawCredential::from_oid4vci.

The StandardFormat::W3c arm was calling serde_json::to_vec(&credential.value) to produce the payload bytes. When the credential value is a serde_json::Value::String (which it is for jwt_vc_json and jwt_vc_json-ld), this JSON-encodes the string again, wrapping the raw JWT bytes in literal " characters. This causes a FormatException: Invalid base64 data error on the client side when attempting to decode the JWT.

The other string-based format arms (DcSdJwt, MsoMdoc, vc+sd-jwt) already handle this correctly by extracting the inner string with pattern matching before calling .into_bytes(). This PR applies the same pattern to the W3c arm, while preserving the serde_json::to_vec path for ldp_vc where the credential value is a JSON object.

Bug introduced in ecf7eb2 ("Migrate OID4VCI 1.0 (#269)").

Changes

  • rust/src/oid4vci/credential.rs: Extract string values before converting to bytes in the W3c arm, matching the pattern used by all other string-based formats
  • rust/src/tests.rs: Add regression tests for jwt_vc_json, jwt_vc_json-ld, and ldp_vc payload encoding

Add comment verifying why unwrap is acceptable in this case

Co-authored-by: Ryan Tate <ryan.tate@spruceid.com>
@spruceduncan spruceduncan merged commit 3ec4545 into main Feb 17, 2026
4 checks passed
@spruceduncan spruceduncan deleted the fix/jwt-serialization-fix branch February 17, 2026 20:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants