2

I need to verify the users session of Drupal on a Node.js server. The session ID has been hashed and it is stored in the Drupal 8 database. How can I hash the browsers session ID to compare it with the one stored in the database?

  • 1
    Check out lib/Drupal/Core/Session/SessionHandler.php, specifically the read function. It uses Drupal\Component\Utility\Crypt::hashBase64($sid). – RaisinBranCrunch Apr 29 '17 at 23:10
  • Do you mean compare it with Node.js code? I am not sure you can. – kiamlaluno Apr 30 '17 at 7:30
1

I see that no one has put up an answer for quite a while, so I will put it up here. This has been correctly answered by RaisinBrainCrunch above.

Drupal 8 hashes its session ID before it puts it in the database. The hash function used is hashBase64($sid) under Drupal\Component\Utility\Crypt.

Therefore, I am guessing you will have to write the same function in Node. This is the full function:

public static function hashBase64($data) {
  $hash = base64_encode(hash('sha256', $data, TRUE));
  // Modify the hash so it's safe to use in URLs.
  return str_replace(['+', '/', '='], ['-', '_', ''], $hash);
}

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.