Skip to content

fix: avoid argument limit in webauthn base64url encoding - #1095

Merged
joshuascan merged 5 commits into
magiclabs:masterfrom
samsamtrum:fix-webauthn-large-base64url
Aug 11, 2026
Merged

fix: avoid argument limit in webauthn base64url encoding#1095
joshuascan merged 5 commits into
magiclabs:masterfrom
samsamtrum:fix-webauthn-large-base64url

Conversation

@samsamtrum

@samsamtrum samsamtrum commented May 26, 2026

Copy link
Copy Markdown
Contributor

The WebAuthn Base64URL encoder currently spreads the full byte array into String.fromCharCode. Large buffers can exceed the JavaScript argument limit and throw a RangeError before encoding.

This keeps the same byte-to-string conversion, but processes the input in bounded chunks before calling btoa. That avoids passing the entire buffer as function arguments at once while preserving the encoded output.

Verified with a local Node check:

  • outputs match the existing implementation for 0, 1, 2, 3, 32, 1024, and 100000 byte buffers
  • existing implementation throws RangeError for a 200000 byte buffer
  • updated implementation encodes the 200000 byte buffer successfully

I also tried a direct TypeScript check for this file, but the partial dependency install in this workspace is missing several type packages, so that command fails in node_modules type resolution before validating this file.

@samsamtrum
samsamtrum requested a review from a team as a code owner May 26, 2026 01:08

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Updates the WebAuthn Base64URL encoder to avoid JavaScript function-argument limits by chunking byte-to-string conversion before calling btoa, preventing RangeError on large ArrayBuffers.

Changes:

  • Convert the input ArrayBuffer to a Uint8Array once and encode via chunked String.fromCharCode(...) calls.
  • Join chunked strings and pass the result to globalThis.btoa to preserve existing output formatting.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Comment thread packages/@magic-ext/webauthn/src/utils/base64.ts Outdated
@joshuascan joshuascan added the patch Increment the patch version when merged label Aug 11, 2026
@joshuascan

Copy link
Copy Markdown
Member

@samsamtrum merging this in now (sorry for the delay!). it will be published shortly as 27.9.1.

@joshuascan
joshuascan added this pull request to the merge queue Aug 11, 2026
Merged via the queue into magiclabs:master with commit 345bd66 Aug 11, 2026
3 of 5 checks passed
@Ethella Ethella added the released This issue/pull request has been released. label Aug 11, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

patch Increment the patch version when merged released This issue/pull request has been released.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants