javascript 如何解码使用 Connect 的 cookieSession 设置的 cookie 秘密？

How to decode a cookie secret, set using Connect's cookieSession?

提问by rdrey

I am setting a cookie using Connect's cookieSession(). This seems to encrypt the cookie's secret value, returning something like 's:j:{}.8gxCu7lVJHVs1gYRPFDAodK3+qPihh9G3BcXIIoQBhM'

我正在使用 Connect 的cookieSession(). 这似乎加密了 cookie 的秘密值，返回类似 's:j:{}.8gxCu7lVJHVs1gYRPFDAodK3+qPihh9G3BcXIIoQBhM' 的内容

How do I decrypt the cookie's value?

如何解密 cookie 的值？

Example code:

示例代码：

app.use(express.bodyParser());
app.use(express.cookieParser());

app.get('/setcookie', function(req, res, next){
    res.app.use(express.cookieSession({ key: "test", secret: "test" }));
    console.log(req.cookies.test);
    res.end();
});

app.get('/', function(req, res, next){
    console.log(req.cookies.test);
    res.end();
});

回答by rdrey

Hmmm... you seem to be a bit confused about the use of cookie sessions.

嗯……您似乎对 cookie 会话的使用有些困惑。

1. Your /setcookiepath doesn't set any cookie/session values. To use a cookie session, you need to set some values on req.session, for example req.session.message = "Hi there!"These values are now stored in the cookie.

2. You can't res.app.use()in just one callback, the request session won't work anywhere else this way. To read those cookies in another request, put the app.use(express.cookieSession({ key: "test", secret: "test" }));at the application level.

1. 您的/setcookie路径未设置任何 cookie/会话值。要使用 cookie 会话，您需要在 上设置一些值req.session，例如req.session.message = "Hi there!"这些值现在存储在 cookie 中。

2. 你不能res.app.use()只在一个回调中，请求会话不会以这种方式在其他任何地方工作。要在另一个请求中读取这些 cookie，请将 放在app.use(express.cookieSession({ key: "test", secret: "test" }));应用程序级别。

Edit: Actually I've thought about your res.app.use() call and it could break your app / cause memory to leak by adding more and more middleware layers (cookieSession) to your app, each time someone requests /setcookie. If you want to only add the cookieSession middleware in specific requests, you need to do the following:

编辑：实际上我已经考虑过您的 res.app.use() 调用，它可能会破坏您的应用程序/通过向您的应用程序添加越来越多的中间件层 (cookieSession) 导致内存泄漏，每次有人请求/setcookie. 如果您只想在特定请求中添加 cookieSession 中间件，则需要执行以下操作：

yourParser = express.cookieSession({ key: "test", secret: "test" });
app.get('/', yourParser, ...);
app.get('/setcookie', yourParser, ...);

Solution

解决方案

This is the actual fixed source:

这是实际的固定来源：

app.use(express.bodyParser());
app.use(express.cookieParser());
app.use(express.cookieSession({ key: "test", secret: "test" }));

app.get('/setcookie', function(req, res, next){
    req.session.message = "Hellau there";
    res.end();
});

Now to inspect those values, in app.get('/',...)try this:

现在检查这些值，app.get('/',...)试试这个：

app.get('/', function(req, res, next){
    console.log(req.session); //Yay, this will be available in all requests!
    res.end();
});

Debugging

调试

And to answer the question of how to manually decode what's stored in a cookie, look in connect/lib/middleware/cookieSession.js:

要回答如何手动解码 cookie 中存储的内容的问题，请查看connect/lib/middleware/cookieSession.js：

// cookieParser secret
if (!options.secret && req.secret) {
  req.session = req.signedCookies[key] || {};
} else {
  // TODO: refactor
  var rawCookie = req.cookies[key];
  if (rawCookie) {
    var unsigned = utils.parseSignedCookie(rawCookie, secret);
    if (unsigned) {
      var originalHash = crc16(unsigned);
      req.session = utils.parseJSONCookie(unsigned) || {};
    }
  }
}

It takes req.cookies[key](basically what you've been doing already (req.cookies.test)), pops it into utils.parseSignedCookieand pops that into utils.parseJSONCookie.

它需要req.cookies[key]（基本上是你已经在做的事情 ( req.cookies.test)），将它放入utils.parseSignedCookie并放入utils.parseJSONCookie.

I put your raw cookie string into the utils.js file at the end:

我最后将您的原始 cookie 字符串放入 utils.js 文件中：

var signed = exports.parseSignedCookie(
    's:j:{}.8gxCu7lVJHVs1gYRPFDAodK3+qPihh9G3BcXIIoQBhM'
  , 'test');
var parsed = exports.parseJSONCookie(signed);
console.log(parsed);

and ran that. Guess what I got:

并运行它。猜猜我得到了什么：

{}

Why? Because you never set anything on the req.sessionobject. :)

为什么？因为你从来没有在req.session对象上设置任何东西。:)