I need to verify the users session of Drupal on a Node.js server. The session ID has been hashed and it is stored in the Drupal 8 database. How can I hash the browsers session ID to compare it with the one stored in the database?
-
1Check out lib/Drupal/Core/Session/SessionHandler.php, specifically the read function. It uses Drupal\Component\Utility\Crypt::hashBase64($sid).– RaisinBranCrunchApr 29, 2017 at 23:10
-
Do you mean compare it with Node.js code? I am not sure you can.– apaderno ♦Apr 30, 2017 at 7:30
Add a comment
|
1 Answer
I see that no one has put up an answer for quite a while, so I will put it up here. This has been correctly answered by RaisinBrainCrunch above.
Drupal 8 hashes its session ID before it puts it in the database. The hash function used is hashBase64($sid) under Drupal\Component\Utility\Crypt.
Therefore, I am guessing you will have to write the same function in Node. This is the full function:
public static function hashBase64($data) {
$hash = base64_encode(hash('sha256', $data, TRUE));
// Modify the hash so it's safe to use in URLs.
return str_replace(['+', '/', '='], ['-', '_', ''], $hash);
}
