如何在Node.js中解密owin cookie

Question

I'm working in a node.js application where I'need to decrypt cookies . for cookie enceyption use owin . plz tell me how to decrypt owin cookie in node.js .it save in browser .
thx in advance .

Answer 1

I'm not even sure if this is something you can/should do(from a security perspective) since you would need to know the machine encryption configuration. I'd suggest considering if this is something really necessary to do.

To do this you need to understand how to Decrypt the Cookie on ASP.NET side, and then "port" this to node. You can check this link:

https://lbadri.wordpress.com/2014/11/23/reading-katana-cookie-authentication-middlewares-cookie-from-formsauthenticationmodule/

The critical part will the decryption part. You can decrypt using the MachineProtect.UnProtect method to do this by loading the underlying "encryption" configuration for the machine. Maybe you could try setting a specific machineKey configuration with keys and algorithms and then try unencrypting with those setting from Node.js. However you will need to know how to include the correct "purposes" in the decryption process.

To understand better how Unprotect works check this out: https://github.com/Microsoft/referencesource/blob/master/System.Web/Security/MachineKey.cs#L190

You can browse the reference and see if you can make any sense out of it.