# Decode encrypted appSession cookie in go middleware

**URL:** <https://community.auth0.com/t/decode-encrypted-appsession-cookie-in-go-middleware/151485>\
**Category:** Get Help\
**Tags:** authentication-sessions, sessions\
**Created:** [November 13, 2024, 11:29pm UTC](https://community.auth0.com/t/decode-encrypted-appsession-cookie-in-go-middleware/151485 "2024-11-13T23:29:36Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![auth\_learner](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/auth_learner/32/62176_2.png) [@auth\_learner](https://community.auth0.com/u/auth_learner)\
**Post date:** [November 13, 2024, 11:29pm UTC](https://community.auth0.com/t/decode-encrypted-appsession-cookie-in-go-middleware/151485/1 "2024-11-13T23:29:36Z")

</div>

Ready to post? 🔍 First, try searching for your answer.  
I have a application that has a NextJs web app backed by a Go (Echo server) backend service.

From the UI/Browser if the API call goes from Browser → NextJS web app → Go Backend service. In this case I can extract the access\_token and id\_token from session in the web app and pass it as Authorization header when making the call to my go backend service. This works fine.

But, when from UI/Browser the API call goes directly to my go backend service, Browser → Go Backend service, in the backend service it doesn’t get the Authorization header and instead gets a encrypted Cookie that has “appSession” property. Something like this  
[Next-Locale=en appSession=eyJhbGciOiJkaXIi\<……\>YxN30…gYfzF8D6fWw\<……\>k2zimuwvUg.VmXY\<….\>unzw]

My question is how do I decrypt/parse (or somehow use) this cookie to get access\_token and id\_token or use this cookie somehow to call /userinfo or /oauth/token endpoints in Auth0

---

<div class="post-metadata">

**Author:** ![auth\_learner](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/auth_learner/32/62176_2.png) [@auth\_learner](https://community.auth0.com/u/auth_learner)\
**Post date:** [November 14, 2024, 1:51am UTC](https://community.auth0.com/t/decode-encrypted-appsession-cookie-in-go-middleware/151485/2 "2024-11-14T01:51:02Z")

</div>

I tried something in Go to try and decrypt the cookie trying to reverse engineer the way I think this gets encrypted in nextjs-auth0 library.

```auto
// Define your initial keying material (IKM) and salt
	ikm := []byte("XXX") // XXX is the AUTH0_SECRET from my .env file. Based on how they suggest to setup AUTH0_SECRET here https://auth0.com/docs/quickstart/webapp/nextjs/01-login#configure-the-sdk 
	salt := []byte("")

	// Create a new HKDF instance with SHA-256 as the hash function
	hkdfReader := hkdf.New(sha256.New, ikm, salt, []byte("JWE CKE"))

	// Derive a key of length 32 bytes
	key := make([]byte, 32)
	if _, err := io.ReadFull(hkdfReader, key); err != nil {
		panic(err)
	}

	fmt.Printf("Derived key: %x\n", key)

	jweRaw := "eyJhbGciOiJkaXIi<……>YxN30…gYfzF8D6fWw<...>k2zimuwvUg.VmXY<….>unzw" // appSession value from Cookie
	jwe, err1 := jose.ParseEncrypted(jweRaw)
	if err1 != nil {
		fmt.Printf("Error Failed to parse jweRaw")
	}
	//fmt.Printf(jwe.KeyID)
	decrypted, err := jwe.Decrypt(key)
	if err != nil {
		panic(err)
	}
	fmt.Printf(string(decrypted))

```

But with this I get an error saying when trying to “Decrypt”

```auto
panic: go-jose/go-jose: error in cryptographic primitive

```

---

<div class="post-metadata">

**Author:** ![auth\_learner](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/auth_learner/32/62176_2.png) [@auth\_learner](https://community.auth0.com/u/auth_learner)\
**Post date:** [November 15, 2024, 5:46pm UTC](https://community.auth0.com/t/decode-encrypted-appsession-cookie-in-go-middleware/151485/3 "2024-11-15T17:46:26Z")

</div>

Hi, could someone from Auth0 support pls help take a look at this. Thanks

---

<div class="post-metadata">

**Author:** ![vlad.murarasu](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/vlad.murarasu/32/72793_2.png) [@vlad.murarasu](https://community.auth0.com/u/vlad.murarasu)\
**Post date:** [April 2, 2025, 2:39pm UTC](https://community.auth0.com/t/decode-encrypted-appsession-cookie-in-go-middleware/151485/4 "2025-04-02T14:39:11Z")

</div>

Hi @auth_learner,

Welcome to the Auth0 Community.

You can try this Go API SDK Quickstart. It should put you on the right track.

> **[Auth0 Go API SDK Quickstarts: Authorization](https://auth0.com/docs/quickstart/backend/golang/01-authorization#create-a-middleware-to-validate-access-tokens)**
>
> This tutorial demonstrates how to add authorization to a Go API.

If you have any other question feel free to reach out.

Have a good one,  
Vlad

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [April 16, 2025, 2:39pm UTC](https://community.auth0.com/t/decode-encrypted-appsession-cookie-in-go-middleware/151485/5 "2025-04-16T14:39:34Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.