在.NET 6中解密Cookie失败,并显示“有效负载无效”,

xvw2m8pv  于 2023-01-14  发布在  .NET
关注(0)|答案(1)|浏览(208)

使用我们的NET 6.0 Web应用程序,我试图解密一个cookie并将内容显示给我的日志记录器/日志接收器。
我一直收到以下错误消息:The payload was invalid.
我在cookie罐/浏览器里有几个cookie,特别是.AspNetCore.Cookies cookie。
这是我想做的:

var cookie = Request.Cookies[".AspNetCore.Cookies"];
var content = DecryptCookie(_dataProtectionProvider, cookie.Key, cookie.Value); 
logger.LogInformation(content);

private static string DecryptCookie(IDataProtectionProvider provider, string cookieKey, string cookieValue)
{
    var dataProtector = provider.CreateProtector("Microsoft.AspNetCore.Authentication.Cookies.CookieAuthenticationMiddleware", cookieKey, "v2");

    // Get the decrypted cookie as plain text.
    UTF8Encoding specialUtf8Encoding = new UTF8Encoding(encoderShouldEmitUTF8Identifier: false, throwOnInvalidBytes: true);
    byte[] protectedBytes = Base64UrlTextEncoder.Decode(cookieValue);
    byte[] plainBytes = dataProtector.Unprotect(protectedBytes);
    string plainText = specialUtf8Encoding.GetString(plainBytes);

    // Get the decrypted cookie as a Authentication Ticket.
    TicketDataFormat ticketDataFormat = new TicketDataFormat(dataProtector);
    AuthenticationTicket ticket = ticketDataFormat.Unprotect(cookieValue);

    return "This is working!!!"; // Yes, I know. This will be the plainText? Not sure just yet.
}

但它在这里不断死去:

更多信息:
至于DataProtectionProvider的设置,我不确定,这是本地主机开发(我刚刚按了F5)所以我不确定它是否只是InMemory,或者它是否使用了Redis(我想有人在生产中说过他们使用Redis是有原因的。我想是因为共享cookie之类的吧?我不太确定)。这是一个Redis XML商店(impliments IXmlRepository)。不确定这是否意味着什么,在这里。
有谁能解释一下为什么这不管用吗?

编辑1:

其他地方的另一个建议是:

private static string DecryptCookie(IDataProtectionProvider provider, string cookieKey, string cookieValue)
{
    var dataProtector = provider.CreateProtector("Microsoft.AspNetCore.Authentication.Cookies.CookieAuthenticationMiddleware", cookieKey, "v2");

    return dataProtector.Unprotect(cookieValue);
}

这也会返回相同的异常/错误消息。
这就像我无法生成一个有效/正确的CreateProtector

taor4pac

taor4pac1#

有两个戏法
1 -需要使用与身份验证票证“受保护”相同的值

  • "Microsoft.AspNetCore.Authentication.Cookies.CookieAuthenticationMiddleware"
  • "Cookies"

2 -需要将cookie值转换为AuthenticationTicket,然后再尝试取消保护。

private static string DecryptCookie(IDataProtectionProvider provider, string cookieKey, string cookieValue)
    {  
        // Data protector has to be the same one used when the cookie is Protected.
        var dataProtector = provider.CreateProtector(
            "Microsoft.AspNetCore.Authentication.Cookies.CookieAuthenticationMiddleware",
            "Cookies",
            "v2");
    
        // The cookie data is in the form of a 'Ticket Data'. So we unprotect it, to that.
        var ticketDataFormat = new TicketDataFormat(dataProtector);
        var ticket = ticketDataFormat.Unprotect(cookieValue, "");
    
        // Lets get -some- data from the cookie.
        // The 'Principal' is more or less, unable to be serialized.
        var cookieProperties = JsonConvert.SerializeObject(ticket.Properties);
    
        return cookieProperties; // FOR EXAMPLE.
    }

相关问题