Cesium for Unreal (v2.28.0, UE 5.8) — Unable to authorize with Cesium ion (OAuth "Unable to decode base64 payload" + manual token also fails)

Cesium for Unreal
1

Subject: Cesium for Unreal (v2.28.0, UE 5.8) — Cannot authorize with Cesium ion

Hi Cesium team,

I’m unable to connect Cesium for Unreal (v2.28.0) to my Cesium ion account on Unreal Engine 5.8.0 (Windows 11).

Using the “Connect” (OAuth) button: the browser login/authorization succeeds, but the Editor never completes the connection. The Output Log shows:

LogCesiumEditor: Error: Errors connecting to Cesium ion:

  • Failed to complete authorization:
  • Unable to decode base64 payload.

This happens on every attempt. I also noticed other HTTPS requests failing around the same time with libcurl SSL errors (error 35), which made me suspect my local proxy (127.0.0.1:7897), but disabling the proxy didn’t fix it.

As a workaround, I manually pasted an access token into Project Settings → Cesium ion Access Token — this also fails to connect.

Separately, when generating a token directly on ion.cesium.com, I got: “POST with passive cookie authorization must include a valid x-cesium-csrf header.”

I’ve tried an incognito browser window and an existing token, with no success.

Could you help identify the root cause, or suggest a way to authorize without the Editor’s own OAuth callback? Happy to share full logs.

Thanks,
Ayer

3

Hi Ayer, welcome to the community, and thanks for the detailed report.

I looked into this and I think it’s a potential bug in the plugin’s token parsing rather than anything on your end. Your browser authorization and the token exchange actually look like they succeed, the failure looks like it happens one step later when the plugin decodes the token’s payload.

Tokens are JWTs, which use base64url encoding (- and _ instead of + and /). The decoder in cesium-native only accepts the standard base64 alphabet, so a token whose payload happens to contain - or _ fails to decode. Most tokens don’t contain those characters, which would explain why most people sign in fine while it fails for you every time. The manual token path you tried goes through the same parser, so that would be blocked by the same problem.

There’s at least one other report that looks like the same thing (this topic, where the same account worked on plugin 2.21 and failed on 2.26).

Could you check one thing to confirm? Take the token string (don’t post it here), split it on the two . characters, and look at the middle part. If it contains any - or _ characters, that confirms it. Just a yes or no is all we need.

It would also be helpful for you to test on a previous version of the Cesium for Unreal Plugin (e.g. version 2.21 like that other user)

If it’s confirmed, we’ll file an issue on the cesium-native GitHub repo and I’ll link it here so you can follow along.

On the other two errors: I believe the libcurl error 35 (SSL connect error) and the x-cesium-csrf error on ion.cesium.com are separate, most likely related to your local proxy doing TLS interception. The base64 failure most likely isn’t caused by your network though.

Happy to look at the full logs if the check doesn’t confirm this.

Let me know how that goes!