undefined | Better HN

0 pointsaskvictor1y ago0 comments

The problem is the following two lines produce different outputs, despite having content that means the same thing:

    console.log(JSON.stringify({ x: 5, y: 6 }));
    console.log(JSON.stringify({ y: 6, x: 5 }));

0 comments

busymom01y ago

I think the relevance of order is allowed to be up to each software's implementation:

https://datatracker.ietf.org/doc/html/rfc8259

Says:

> JSON parsing libraries have been observed to differ as to whether or not they make the ordering of object members visible to calling software. Implementations whose behavior does not depend on member ordering will be interoperable in the sense that they will not be affected by these differences.

So, different signature makes sense. But it should not be an issue as long as both software are calculating/validating the signature on the string and not json.

heinrich59911y ago

Usually, this is not a problem for signing.

askvictorOP1y ago

Depends on your use case. We have this problem currently where I work.

j / k navigate · click thread line to collapse