What happens?

Base64url encoding is sensitive to whitespaces (like new lines). The spec makes no statements where Whitespaces in Base64Url-encoded json-payloads should be removed - serverside or clientside.

Why is this wrong?

If the servers assume that clients remove whitespaces, they will not match json-structures that are in fact equivalent.

How should it be fixed?

Make statement if server or client should remove whitespaces.

• I have signed the required Developer Certificate of Origin (DCO) already.