CakePHP reading encrypted cookie values - php

Question

I set cookies like this:
$this->Cookie->write('mycookie', $data, TRUE, '30 days');
And I read them like this:
$cookieData = $this->Cookie->read('mycookie');
But for security concerns I read some of the cookies like this:
$cookieRaw= $_COOKIE['CakeCookie']['mycookie'];
And I write this raw cookie to my database. Then I need to read the content of the cookie.
But as you know raw cookie is something like "Q2FrZQ=dsdsaDASDasdasdsa".
So I need to read the content of the cookie.
It seems like CookieComponent:read() uses protected CookieComponent:_decrypt function. I don't want to copy paste the _decrypt() contents. Is there an easier way to read decrypted CakePHP strings ?

Answer 1

I don't see a reason for not using CookieComponent, for your information this component DO encrypt whatever you write. Here is an extract of the documentation
All values in the cookie are encrypted by default. If you want to store the values as plain-text, set the third parameter of the write() method to false. The encryption performed on cookie values is fairly uncomplicated encryption system. It uses Security.salt and a predefined Configure class var Security.cipherSeed to encrypt values. To make your cookies more secure you should change Security.cipherSeed in app/Config/core.php to ensure a better encryption.:

Answer 2

If you need to store the data encrypted, then I'd suggest to encrypt it yourself instead of relying on the cookie component internals.
ie, read the cookie data using the cookie component so that you end up with the decrypted data, then encrypt it with your favorite encryption algorithm (I'd suggest to use Security::rijndael()) and store it in the database, that way you have proper control over the data.
Another option would be to create a custom component that extends the cookie component and makes the decrypting functionality public. However I really don't think that's a good idea, the data in the DB shouldn't be a components concern, this is something that fits way better in the model layer.
If you insist using the mundged cookie data and decrypting it manually, then you'll have to do the same as can be seen in the CookieComponent code. First strip the Q2FrZQ==. from the data, then base64 decode it, afterwards decrypt it according to the method used by the cookie component (Security::cipher() by default, which is btw deprecated), and finally JSON decode it if necessary as in CookieComponent::_explode().
Assuming that only Cake 2.x style cookie data is used, and that the data is expected to be always encrypted, then it could be broken down to this (where the decryption method might need to be adjusted, depending on the cookie component configuration):
$data = substr($data, 8);
$data = base64_decode($data);
$data = Security::cipher($data, Configure::read('Security.salt'));
$first = substr($data, 0, 1);
if ($first === '{' || $first === '[') {
$decoded = json_decode($data, true);
if($decoded !== null) $data = $decoded;
}
However this heavily relies on the cookie component internals and configuration, so again, this is anything but recommended!