# Given the session key and secret, how can we decrypt cookie-based sessions?

**URL:** <https://www.ruby-forum.com/t/given-the-session-key-and-secret-how-can-we-decrypt-cookie-based-sessions/180555>\
**Category:** Rails\
**Created:** [December 21, 2009, 6:26pm UTC](https://www.ruby-forum.com/t/given-the-session-key-and-secret-how-can-we-decrypt-cookie-based-sessions/180555 "2009-12-21T18:26:57Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![joeg](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/dc4da7/32.png) [@joeg](https://www.ruby-forum.com/u/joeg)\
**Post date:** [December 21, 2009, 6:26pm UTC](https://www.ruby-forum.com/t/given-the-session-key-and-secret-how-can-we-decrypt-cookie-based-sessions/180555/1 "2009-12-21T18:26:57Z")

</div>

Hello all. I’ve got a question about how Rails handles cookie  
encryption/decryption.

I’ve got this in my config/environment.rb

config.action\_controller.session = {  
:session\_key =\> [some key],  
:secret =\> [some secret]  
}

And this in config/environment/production.rb et al.:

ActionController::Base.session\_options[:session\_domain] = [some  
domain]

So far, so good – as long as all my Rails apps have the same  
session\_key and secret, and are on the same domain, they can all use  
that same cookie.

However, a colleague now has a JSP application (on the same domain),  
with which he’d like to read the cookies I have set.

So, given a secret and an encrypted cookie value, how would we decrypt  
it to get the contents of that cookie?

(The docs seem to indicate this is one-way SHA1 encryption by default  
– [http://caboo.se/doc/classes/CGI/Session/CookieStore.html](http://caboo.se/doc/classes/CGI/Session/CookieStore.html) – but  
then how would my Rails applications read the contents of a cookie  
that is one-way encrypted?)

Thanks in advance for any tips/pointers/insight,  
Joe

–

You received this message because you are subscribed to the Google  
Groups “Ruby on Rails: Talk” group.  
To post to this group, send email to removed\_email\_address@domain.invalid.  
To unsubscribe from this group, send email to  
removed\_email\_address@domain.invalid.  
For more options, visit this group at  
[http://groups.google.com/group/rubyonrails-talk?hl=en](http://groups.google.com/group/rubyonrails-talk?hl=en).

---

<div class="post-metadata">

**Author:** ![joeg](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/dc4da7/32.png) [@joeg](https://www.ruby-forum.com/u/joeg)\
**Post date:** [December 21, 2009, 8:36pm UTC](https://www.ruby-forum.com/t/given-the-session-key-and-secret-how-can-we-decrypt-cookie-based-sessions/180555/2 "2009-12-21T20:36:19Z")

</div>

> So, given a secret and an encrypted cookie value, how would we decrypt  
> it to get the contents of that cookie?
> 
> (The docs seem to indicate this is one-way SHA1 encryption by default  
> –[http://caboo.se/doc/classes/CGI/Session/CookieStore.html--](http://caboo.se/doc/classes/CGI/Session/CookieStore.html--) but  
> then how would my Rails applications read the contents of a cookie  
> that is one-way encrypted?)

session cookies aren’t encrypted (there is a cryptographic signature  
to prevent tampering but the data isn’t encrypted).

The data is a base 64 encoded marshaled ruby object. in ruby it is  
dead easy : strip off the signature (including and after the --) and  
do  
Marshal.load(ActiveSupport::Base64.decode64(blob\_of\_data)). You would  
probably need to reimplement part of ruby’s marshalling algorithm to  
decode the data (the marshal format is documented)

Fred.

> Thanks in advance for any tips/pointers/insight,  
> Joe

–

You received this message because you are subscribed to the Google  
Groups “Ruby on Rails: Talk” group.  
To post to this group, send email to removed\_email\_address@domain.invalid.  
To unsubscribe from this group, send email to  
removed\_email\_address@domain.invalid.  
For more options, visit this group at  
[http://groups.google.com/group/rubyonrails-talk?hl=en](http://groups.google.com/group/rubyonrails-talk?hl=en).