Run results for: JWT Decode vs Standard cookie pull regex vs select value

Run details:

User agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36

Browser: Chrome 144

Operating system: Mac OS X 10.15.7

Device Platform: Desktop

Date tested: 3 months ago

Test name	Executions per second
Atob decode	273350.5 Ops/sec
Check for value in cookie	4740533.0 Ops/sec
No header decode	295674.5 Ops/sec
longer string decode	278911.0 Ops/sec
jwt select a value	272879.8 Ops/sec
cookie select a value	4662960.0 Ops/sec

HTML Preparation code:

<!--your preparation HTML code goes here-->

Script Preparation code:

window.testCookie = "features=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiYWRtaW4iOnRydWUsImlhdCI6MTUxNjIzOTAyMn0.KMUFsIDTnFmyG3nMiGM6H9FNFUROf3wh7SmqJp-QV30; SameSite=None; Secure; monsterfeatures=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJuZXZlcl9nb25uYSI6eyJnaXZlX3lvdV91cCI6dHJ1ZSwibGV0X3lvdV9kb3duIjp0cnVlLCJydW5fYXJvdW5kIjp0cnVlLCJkZXNlcnRfeW91Ijp0cnVlLCJtYWtlX3lvdV9jcnkiOnRydWUsInNheV9nb29kYnllIjp0cnVlLCJ0ZWxsX2FfbGllIjp0cnVlLCJodXJ0X3lvdSI6dHJ1ZX19.6koygZP5DnSgnB0dz7o3hrdruZBSrb0LIHLJbO-rPKU; SameSite=None; Secure";

window.getCookie = (name) => {
    const value = `; ${window.testCookie}`;
    const parts = value.split(`; ${name}=`);
    if (parts.length === 2) return parts.pop().split(';').shift();
}

Tests:

Atob decode
var features = window.getCookie('features'); let decodedData = false; function jwtDecode(t) { let token = {}; token.raw = t; token.header = window.atob(t.split('.')[0]); token.payload = window.atob(t.split('.')[1]); return token; } try { decodedData = features === undefined ? false : jwtDecode('features'); // decode the string } catch (e) {} let result = decodedData ? decodedData.payload.includes('free:true') : false;
Check for value in cookie
var features = window.getCookie('features'); features.includes('eyJ');
No header decode
var features = window.getCookie('features'); let decodedData = false; function jwtDecode(t) { let token = {}; token.raw = t; token.payload = window.atob(t.split('.')[1]); return token; } try { decodedData = features === undefined ? false : jwtDecode('features'); // decode the string } catch (e) {} let result = decodedData ? decodedData.payload.includes('free:true') : false;
longer string decode
var features = window.getCookie('monsterfeatures'); let decodedData = false; function jwtDecode(t) { let token = {}; token.raw = t; token.header = window.atob(t.split('.')[0]); token.payload = window.atob(t.split('.')[1]); return token; } try { decodedData = features === undefined ? false : jwtDecode('features'); // decode the string } catch (e) {} let result = decodedData ? decodedData.payload.includes('free:true') : false;
jwt select a value
var features = window.getCookie('features'); let decodedData = false; function jwtDecode(t) { let token = {}; token.raw = t; token.header = window.atob(t.split('.')[0]); token.payload = window.atob(t.split('.')[1]); return token; } try { decodedData = features === undefined ? false : jwtDecode('features'); // decode the string } catch (e) {} let result = decodedData ? decodedData.payload[5] : false;
cookie select a value
var features = window.getCookie('features'); features[5];

Run results for: JWT Decode vs Standard cookie pull regex vs select value

Check the JWT decode

Atob decode

Check for value in cookie

No header decode

longer string decode

jwt select a value

cookie select a value