Search code examples
asp.netsecurityasp.net-web-apiasp.net-identityowin

Is there a way to Deserialize ProtectedTicket in AspNetUser Table?


Based on what i know (correct me if i am wrong) the 'access_token' is equivalent to the 'protected ticket' field in AspNetUser table. It's just hashed.

What i am planning to do is deserialize the protected ticket to get the access_token value.

I am trying to support a SSO scenario wherein, the user can access multiple application using the same access token.


Solution

  • Unfortunately, if the hash function used is a cryptographic hash, which the circumstances suggest, this is definitionally impossible (or should be...). Cryptographic hash functions are designed to be extremely expensive (ideally impossible) to reverse, and so the most effective method you have would be to attempt to brute-force the hash, I.e. running inputs through the hash function until you get one that produces the output you want. Even then, there's no telling how long it would take you to find it. It is strongly recommended not to write anything that depends on routinely brute-forcing a cryptographic hash.

    Of course, its possible that the possible inputs are incredibly small (I.e. at most 16 bits or so), or that the function used is not a cryptographic hash function (I.e. its something like base64 encoding or rot-13). In that case, you might have a method to reverse the "hash" efficiently.

    However, I strongly suspect that is not the case. In this endeavour, I think you are simply out of luck, and will have to find another way to get the functionality you desire.