{"action":"created","issue":{"url":"https://api.github.com/repos/koajs/session/issues/110","repository_url":"https://api.github.com/repos/koajs/session","labels_url":"https://api.github.com/repos/koajs/session/issues/110/labels{/name}","comments_url":"https://api.github.com/repos/koajs/session/issues/110/comments","events_url":"https://api.github.com/repos/koajs/session/issues/110/events","html_url":"https://github.com/koajs/session/issues/110","id":287725619,"node_id":"MDU6SXNzdWUyODc3MjU2MTk=","number":110,"title":"Reproducing keygrip verification","user":{"login":"blaesus","id":233354,"node_id":"MDQ6VXNlcjIzMzM1NA==","avatar_url":"https://avatars2.githubusercontent.com/u/233354?v=4","gravatar_id":"","url":"https://api.github.com/users/blaesus","html_url":"https://github.com/blaesus","followers_url":"https://api.github.com/users/blaesus/followers","following_url":"https://api.github.com/users/blaesus/following{/other_user}","gists_url":"https://api.github.com/users/blaesus/gists{/gist_id}","starred_url":"https://api.github.com/users/blaesus/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/blaesus/subscriptions","organizations_url":"https://api.github.com/users/blaesus/orgs","repos_url":"https://api.github.com/users/blaesus/repos","events_url":"https://api.github.com/users/blaesus/events{/privacy}","received_events_url":"https://api.github.com/users/blaesus/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2018-01-11T09:57:12Z","updated_at":"2018-12-17T11:53:19Z","closed_at":"2018-12-17T11:53:19Z","author_association":"NONE","body":"## Summary\r\n\r\nI hope to reproduce cookie keygrip verification for my websocket server and failed. I wonder where I can find exactly how koa-session verifies the cookie so that I can reproduce it correctly. Alternative methods to get `koa-session` working with `WebSocket` are also welcome.\r\n\r\n## Background\r\n\r\nMy app has two interfaces: a HTTP interface, which runs on Koa with koa-session, with signature; and a WebSocket interface, which runs on `ws`.\r\n\r\nI hope the `ws` server would verify cookie signature the same way koa-session does.\r\n\r\nThe existing solution at https://github.com/koajs/session/issues/53#issuecomment-311601304 doesn't work for me.\r\n\r\n## Attempted solution\r\n\r\nI tried to write a function to parse cookie and verify signature the same way koa-session did. The parsing works but verification fails.\r\n\r\nPerhaps I got Keygrip parameters wrong. I try searching the source code in koa-session but couldn't find Keygrip reference, or anything looking relevant.\r\n\r\nThe parsing function (in TypeScript) is as follows. It successfully parsed the cookie string but failed to verify it. If I disable signature verification, it works as expected otherwise.\r\n\r\n```typescript\r\nimport * as cookie from 'cookie'\r\nimport * as Keygrip from 'keygrip'\r\nimport { SESSION_KEY, SESSION_KEYGRIP_KEYS, SESSION_SIGNATURE_KEY } from 'settings'\r\n\r\nconst keys = new Keygrip(SESSION_KEYGRIP_KEYS)\r\n\r\nexport function parseCookie(cookieIncoming: string | string[] | undefined): {[key in string]?: string} {\r\n    if (!cookieIncoming) {\r\n        return {}\r\n    }\r\n    const cookieString: string = typeof cookieIncoming === 'string' ? cookieIncoming : cookieIncoming.join('')\r\n    const cookieObj = cookie.parse(cookieString)\r\n    const mainCookie: string = cookieObj[SESSION_KEY] || ''\r\n    const cookieSignature: string = cookieObj[SESSION_SIGNATURE_KEY] || ''\r\n    console.info('cookie', mainCookie)\r\n    console.info('signature', cookieSignature)\r\n    if (!keys.verify(mainCookie, cookieSignature)) {\r\n        console.info('bad signature')\r\n        return {}\r\n    }\r\n    else {\r\n        const session: string = Buffer.from(mainCookie, 'base64').toString('ascii')\r\n        try {\r\n            return JSON.parse(session)\r\n        }\r\n        catch {\r\n            return {}\r\n        }\r\n    }\r\n}\r\n```\r\n\r\nOutput:\r\n```\r\n17:48:01 0|actionAp | cookie eyJhdXRoVG9rZW5JZCI6IjI4YmZmNWExLTFkMzUtNDk0Yi1hZGNjLTFhOWM3NmI0NTg0OSIsInRva2VuU2VjcmV0IjoiOGZlMGFkZDVmNWI0 // Truncated for security reasons\r\n17:48:01 0|actionAp | signature l0i1WS8fV9JkZwQWCWCt0HEPyWM\r\n17:48:01 0|actionAp | bad signature\r\n```"},"comment":{"url":"https://api.github.com/repos/koajs/session/issues/comments/447819031","html_url":"https://github.com/koajs/session/issues/110#issuecomment-447819031","issue_url":"https://api.github.com/repos/koajs/session/issues/110","id":447819031,"node_id":"MDEyOklzc3VlQ29tbWVudDQ0NzgxOTAzMQ==","user":{"login":"blaesus","id":233354,"node_id":"MDQ6VXNlcjIzMzM1NA==","avatar_url":"https://avatars2.githubusercontent.com/u/233354?v=4","gravatar_id":"","url":"https://api.github.com/users/blaesus","html_url":"https://github.com/blaesus","followers_url":"https://api.github.com/users/blaesus/followers","following_url":"https://api.github.com/users/blaesus/following{/other_user}","gists_url":"https://api.github.com/users/blaesus/gists{/gist_id}","starred_url":"https://api.github.com/users/blaesus/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/blaesus/subscriptions","organizations_url":"https://api.github.com/users/blaesus/orgs","repos_url":"https://api.github.com/users/blaesus/repos","events_url":"https://api.github.com/users/blaesus/events{/privacy}","received_events_url":"https://api.github.com/users/blaesus/received_events","type":"User","site_admin":false},"created_at":"2018-12-17T11:53:19Z","updated_at":"2018-12-17T11:53:19Z","author_association":"NONE","body":"Thanks, I'll dig into that."}}
{"actor":{"display_login":"blaesus"}}