I need to verify the users session of Drupal on a Node.js server. The session ID has been hashed and it is stored in the Drupal 8 database. How can I hash the browsers session ID to compare it with the one stored in the database?

  • 1
    Check out lib/Drupal/Core/Session/SessionHandler.php, specifically the read function. It uses Drupal\Component\Utility\Crypt::hashBase64($sid). Apr 29, 2017 at 23:10
  • Do you mean compare it with Node.js code? I am not sure you can.
    – apaderno
    Apr 30, 2017 at 7:30

1 Answer 1


I see that no one has put up an answer for quite a while, so I will put it up here. This has been correctly answered by RaisinBrainCrunch above.

Drupal 8 hashes its session ID before it puts it in the database. The hash function used is hashBase64($sid) under Drupal\Component\Utility\Crypt.

Therefore, I am guessing you will have to write the same function in Node. This is the full function:

public static function hashBase64($data) {
  $hash = base64_encode(hash('sha256', $data, TRUE));
  // Modify the hash so it's safe to use in URLs.
  return str_replace(['+', '/', '='], ['-', '_', ''], $hash);

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.