How to decrypt .AspNetCore.Identity.Application cookie in ASP.NET Core 3.0?

Question

I'd like to manually decrypt the .AspNetCore.Identity.Application cookie that gets stored by ASP.NET Core 3.0.0 to see exactly what information it contains. I understand that Microsoft have quite significantly changed how this is done between ASP.NET Core 2.2 and 3.0, so now that 3.0 has been released to general availability, I'd like to know: how can I manually decrypt this cookie in my application code in Core 3.0?

Jez · Accepted Answer · 2019-10-14 17:14:20Z

6

This is how you can decrypt a cookie based on CookieAuthenticationHandler

public class Startup
{
    private CookieAuthenticationOptions _storedOption;


    public void ConfigureServices(IServiceCollection services)
    {
        services.AddAuthentication()
            .AddCookie(option =>
            {
                _storedOption = option;
            });
    }

    public AuthenticationTicket Decrypt(HttpContext context, string cookie)
    {
        AuthenticationTicket ticket = _storedOption.TicketDataFormat.Unprotect(cookie, GetTlsTokenBinding(context));
        return ticket;
    }

    public string DecryptRaw(HttpContext context, string cookie)
    {
        IDataProtectionProvider dataProtectionProvider = _storedOption.DataProtectionProvider;

        IDataProtector protector = dataProtectionProvider.CreateProtector("Microsoft.AspNetCore.Authentication.Cookies.CookieAuthenticationMiddleware", "Identity.Application", "v2");

        string purpose = GetTlsTokenBinding(context);

        if (!string.IsNullOrEmpty(purpose))
        {
            protector = protector.CreateProtector(purpose);
        }

        var protectedData = Base64UrlTextEncoder.Decode(cookie);

        byte[] userData = protector.Unprotect(protectedData);

        var rawText = Encoding.UTF8.GetString(userData);

        return rawText;
    }

    private string GetTlsTokenBinding(HttpContext context)
    {
        var binding = context.Features.Get<ITlsTokenBindingFeature>()?.GetProvidedTokenBindingId();
        return binding == null ? null : Convert.ToBase64String(binding);
    }
}

edited Oct 14, 2019 at 17:14

Jez

30.5k37 gold badges155 silver badges261 bronze badges

answered Oct 13, 2019 at 12:26

Kahbazi

15.1k3 gold badges52 silver badges80 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

OfirD Over a year ago

It's not very helpful having the decryption code under Startup, as the point is to decrypt a cookie, which is not present during startup. Also, _storedOption is null, unless adding required configurations (e.g., passing ``CookieAuthenticationDefaults.AuthenticationScheme` to services.AddAuthentication). Plus, option => ... should be options => ....

Collectives™ on Stack Overflow

How to decrypt .AspNetCore.Identity.Application cookie in ASP.NET Core 3.0?

1 Answer 1

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related