NodeJS Javascript中HttpServerUtility.UrlTokenEncode的匹配输出 [英] Matching ouput for HttpServerUtility.UrlTokenEncode in NodeJS Javascript

问题描述

我正在看一个dotnet中的示例，该示例如下所示: https://dotnetfiddle.net/t0y8yD.

I am looking at an example in dotnet which looks like the following: https://dotnetfiddle.net/t0y8yD.

HttpServerUtility.UrlTokenEncode方法的输出为:

Pn55YBwEH2S2BEM5qlNrq-LMNE8BDdHYwbWKFEHiPZo1

当我尝试使用encodeURI，encodeURIComponent或其他任何尝试在NodeJS中完成相同操作时，我得到以下信息:

When I try to complete the same in NodeJS with encodeURI, encodeURIComponent or any other attempt I get the following:

Pn55YBwEH2S2BEM5qlNrq+LMNE8BDdHYwbWKFEHiPZo=

从上面可以看到，-"应该是"+"，并且最后一个字符部分是不同的.散列的创建方式相同，并输出相同的缓冲区.

As you can see from the above the '-' should be a '+' and the last character part is different. The hash is created the same and outputs the same buffer.

  var hmac = crypto.createHmac("sha256", buf);
  hmac.update("9644873");
  var hash = hmac.digest("base64");

如何使两者匹配?另一个重要的注意事项是，这是一个用例，我不确定是否还有其他字符可以这样做.

How can I get the two to match? One other important note is that this is one use case and I am unsure if there are other chars that do the same.

我不确定dotnet变体是否正确或NodeJS版本是否正确.但是，将在dotnet端进行比较，因此我需要node来匹配它.

I am unsure if the dotnet variant is incorrect or the NodeJS version is. However, the comparison will be done on the dotnet side, so I need node to match that.

推荐答案

两个结果的差异是由于使用 Base64 编码.

The difference of the two results is caused by the use of Base64URL encoding in the C# code vs. Base64 encoding in node.js.

Base64URL和Base64几乎相同，但是Base64编码使用字符+，/和=，它们在URL中具有特殊含义，因此必须避免.在Base64URL中，将+替换为-，将/替换为_，将=(末尾的填充字符)替换为%20或将其省略.

Base64URL and Base64 are almost identical, but Base64 encoding uses the characters +, / and =, which have a special meaning in URLs and thus have to be avoided. In Base64URL encoding + is replaced with -, / with _ and = (the padding character on the end) is either replaced with %20 or simply omitted.

在您的代码中，您正在计算HMAC-SHA256哈希，因此您将获得256位结果，可以将其编码为32个字节.在Base64/Base64URL中，每个字符代表6位，因此您需要256/6 = 42,66 => 43个Base64字符.如果使用43个字符，则末尾将有2个"lonesome"位，因此添加了填充字符(=). 现在的问题是，为什么HttpServerUtility.UrlTokenEncode在末尾添加1来代替填充字符.我在

In your code you're calculating a HMAC-SHA256 hash, so you get a 256 bit result, which can be encoded in 32 bytes. In Base64/Base64URL every character represents 6 bits, therefore you would need 256/6 = 42,66 => 43 Base64 characters. With 43 characters you would have 2 'lonesome' bits on the end, therefore a padding char (=) is added. The question now is why HttpServerUtility.UrlTokenEncode adds a 1 as a replacement for the padding char on the end. I didn't find anything in the documentation. But you you should keep in mind that it's insignificant anyway.

要在node.js中获得相同的效果，可以使用软件包 base64url ，或仅对base64编码的哈希使用简单的replace语句.

To to get the same in node.js, you can use the package base64url, or just use simple replace statements on the base64 encoded hash.

使用base64url软件包:

With base64url package:

const base64url = require('base64url');
var hmacB64 = "Pn55YBwEH2S2BEM5qlNrq+LMNE8BDdHYwbWKFEHiPZo="
var hmacB64url = base64url.fromBase64(hmacb64)

console.log(hmacB64url)

结果是:

Pn55YBwEH2S2BEM5qlNrq-LMNE8BDdHYwbWKFEHiPZo

如您所见，该库仅省略了填充字符.

as you can see, this library just omits the padding char.

使用replace，也将填充=替换为1:

With replace, also replacing the padding = with 1:

var hmacB64 = "Pn55YBwEH2S2BEM5qlNrq+LMNE8BDdHYwbWKFEHiPZo="
console.log(hmacb64.replace(/\//g,'_').replace(/\+/g,'-').replace(/\=+$/m,'1'))

结果是:

Pn55YBwEH2S2BEM5qlNrq-LMNE8BDdHYwbWKFEHiPZo1

我尝试使用不同的数据编写C#代码，最后总是得到'1'，所以用1替换=似乎可以，尽管它似乎不符合RFC.

I tried the C# code with different data and always got '1' on the end, so to replace = with 1 seems to be ok, though it doesn't seem to be conform to the RFC.

如果您可以选择的话，另一种选择是更改C#代码.使用常规的base64编码加上字符串替换来获取base64url输出，而不是使用HttpServerUtility.UrlTokenEncode

The other alternative, if this is an option for you, is to change the C# code. Use normal base64 encoding plus string replace to get base64url output instead of using HttpServerUtility.UrlTokenEncode

在此处

这篇关于NodeJS Javascript中HttpServerUtility.UrlTokenEncode的匹配输出的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！