URGENT help needed with Realm sign in

Is no one else having this problem? I thought I could just rerun the sign in, but if I get a token that Mongo fails to recognise, I’m stuck with that token until Google decides to invalidate it. Calling GoogleSignInClient.signOut() does not invalidate the token.

My app is live, and intermittently broken for a good number of users, because of something seemingly out of my control. Any suggestions at all would be very gratefully received.

Thanks for your reply. I took a look at the post you mentioned, but it doesn’t really help I’m afraid. I take the token from Google, and I pass it to MongoDb, there’s nothing really in between, so either Google is providing me with bad tokens, or Mongo is not accepting valid tokens.

Could I send you a token that is not working, so you can check this?

Sure thing, the stack trace is:

AUTH_ERROR(realm::app::ServiceError:47): illegal base64 data at input byte 349
	at io.realm.internal.network.NetworkRequest.onError(NetworkRequest.java:68)
	at io.realm.internal.objectstore.OsJavaNetworkTransport.nativeHandleResponse(Native Method)
	at io.realm.internal.objectstore.OsJavaNetworkTransport.handleResponse(OsJavaNetworkTransport.java:98)
	at io.realm.internal.network.OkHttpNetworkTransport.lambda$sendRequestAsync$0$io-realm-internal-network-OkHttpNetworkTransport(OkHttpNetworkTransport.java:100)
	at io.realm.internal.network.OkHttpNetworkTransport$$ExternalSyntheticLambda0.run(Unknown Source:14)
	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1167)
	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:641)
	at java.lang.Thread.run(Thread.java:920)

Do you have an email address I can send the tokens to?

I have pasted one of the failing tokens into https://jwt.io/ and it tells me it’s a valid token

Thanks for your help on this.

With my login, it happens every single time now. I am unable to log in at all.

Thanks for the code example. I’ve made my own test in Kotlin, decoding just the secret from the token:

The secret decoded fine when using URL encoding using both java.util.Base64 and android.util.Base64 libraries, although when I put the same secret into the Go example, it gives an error.

try {
            val urlDecoded = java.util.Base64.getUrlDecoder().decode(secret)
            Log.d("JWT", "URL Decoded: $urlDecoded")
        } catch (e: Exception) {
            Log.d("JWT", "e: $e");
        } // WORKS

        try {
            val decoded = java.util.Base64.getDecoder().decode(secret)
            Log.d("JWT", "Decoded: $decoded")
        } catch (e: Exception) {
            Log.d("JWT", "e: $e");
        } // FAILS

        try {
            val androidDecoded = android.util.Base64.decode(secret, android.util.Base64.DEFAULT)
            Log.d("JWT", "Android Decoded DEFAULT: $androidDecoded")
        } catch (e: Exception) {
            Log.d("JWT", "e: $e");
        } // FAILS

        try {
            val urlAndroidDecoded = android.util.Base64.decode(secret, android.util.Base64.URL_SAFE)
            Log.d("JWT", "Android Decoded URL_SAFE: $urlAndroidDecoded")
        } catch (e: Exception) {
            Log.d("JWT", "e: $e");
        } // WORKS

OK, after a little testing (and learning Go!), I think I’ve found why the error is occuring - the token is presented without padding, meaning that base64.URLEncoding.DecodeString will not work (if the token length is not divisible exactly by the byte length), but base64.RawURLEncoding.DecodeString will.

I worked on this a little more, because currently I cannot use my app.

Adding padding to the token using:

private fun padToken (nonNullToken: String, padDivisor: Int = 4): String {
        val comps = nonNullToken.split(".")
        if (comps.size < 3) return ""
        var token = comps[2]
        val size = token.length
        val padAmount = ((ceil(size.toDouble() / padDivisor) * padDivisor) - size).toInt()
        token = token.padEnd(size + padAmount, '=')
        return "${comps[0]}.${comps[1]}.$token"
    }

generates a string that passes the Go playground above. However, it still does not allow me to sign in, and is also against the JWT spec (jwt.io reports that padded tokens are invalid)