Ready to post? First, try searching for your answer.
I have a application that has a NextJs web app backed by a Go (Echo server) backend service.
From the UI/Browser if the API call goes from Browser → NextJS web app → Go Backend service. In this case I can extract the access_token and id_token from session in the web app and pass it as Authorization header when making the call to my go backend service. This works fine.
But, when from UI/Browser the API call goes directly to my go backend service, Browser → Go Backend service, in the backend service it doesn’t get the Authorization header and instead gets a encrypted Cookie that has “appSession” property. Something like this
[Next-Locale=en appSession=eyJhbGciOiJkaXIi<……>YxN30…gYfzF8D6fWw<……>k2zimuwvUg.VmXY<….>unzw]
My question is how do I decrypt/parse (or somehow use) this cookie to get access_token and id_token or use this cookie somehow to call /userinfo or /oauth/token endpoints in Auth0
I tried something in Go to try and decrypt the cookie trying to reverse engineer the way I think this gets encrypted in nextjs-auth0 library.
// Define your initial keying material (IKM) and salt
ikm := []byte("XXX") // XXX is the AUTH0_SECRET from my .env file. Based on how they suggest to setup AUTH0_SECRET here https://auth0.com/docs/quickstart/webapp/nextjs/01-login#configure-the-sdk
salt := []byte("")
// Create a new HKDF instance with SHA-256 as the hash function
hkdfReader := hkdf.New(sha256.New, ikm, salt, []byte("JWE CKE"))
// Derive a key of length 32 bytes
key := make([]byte, 32)
if _, err := io.ReadFull(hkdfReader, key); err != nil {
panic(err)
}
fmt.Printf("Derived key: %x\n", key)
jweRaw := "eyJhbGciOiJkaXIi<……>YxN30…gYfzF8D6fWw<...>k2zimuwvUg.VmXY<….>unzw" // appSession value from Cookie
jwe, err1 := jose.ParseEncrypted(jweRaw)
if err1 != nil {
fmt.Printf("Error Failed to parse jweRaw")
}
//fmt.Printf(jwe.KeyID)
decrypted, err := jwe.Decrypt(key)
if err != nil {
panic(err)
}
fmt.Printf(string(decrypted))
But with this I get an error saying when trying to “Decrypt”
panic: go-jose/go-jose: error in cryptographic primitive
First, try searching for your answer.