I'm using JWTs as part of an URL in order to direct a user to a specific site. I could have just used a UUID, but it's nice to have an expiry date in the link, as well as knowing whom the link is created for.
This has been working great, but when I email such an URL to someone with Outlook (maybe a specific version of Outlook), the url gets converted to all lower case. This seems like a stupid thing to do, but I guess it's ok since URLs are supposed to be case insensitive.
Would it make sense to generate JWTs with only lowercase characters?
Here is an example.
The original url, sent as a link in an email:
When some versions of Outlook and/or Exchange gets hold of this link it gets converted to this:
Unfortunately the lowercase conversion in Outlook seems to be a thing. Others have the same problem. Here is one example.
This sucks. Of course it is MS who does such a stupid thing. JWTs are supposed to be URL safe.
I guess I'll have to abandon JWTs for my links and put my links in a database instead.