Click here to Skip to main content
15,888,351 members
Please Sign up or sign in to vote.
1.24/5 (3 votes)
On Login page I made a remember me check on this check click saving user name and password in cookies using javascript but i want to save encrypted password cookies so that it can secure. (without using any external JS library please)
Posted
Updated 10-Jan-18 1:55am
v2
Comments
Sergey Alexandrovich Kryukov 30-Apr-15 1:40am    
Why? why "without any external library"? Then write such functions by yourself; what's the problem?
Such libraries are well-known, people use them. Do you really hope that, without any motivation from your side, somebody will set aside one's own business and help you with something which hardly can be perceived as anything but pointless caprice? Why anyone would even try to answer your question?

Anyway, this is not how password protection is supported.

—SA
Muhamad Faizan Khan 30-Apr-15 1:42am    
is there any built in support? i means
Sergey Alexandrovich Kryukov 30-Apr-15 9:56am    
Oh... I don't think there is such thing.
—SA
Muhamad Faizan Khan 30-Apr-15 1:52am    
i also check this
var encrypted = CryptoJS.AES.encrypt("Message", "Secret Passphrase");
alert(encrypted);
var decrypted = CryptoJS.AES.decrypt(encrypted, "Secret Passphrase");
alert(decrypted);
using this https://code.google.com/p/crypto-js/
but result are not same on decryption. what i am missing
Richard Deeming 10-Jan-18 12:42pm    
Not sure why this has popped back into the "active" list, but if anyone else is looking for a solution, the answer is simple:

DON'T DO IT!

There is absolutely no need to store the username and password in a cookie. Ever. Under any circumstances.

If the user wants their credentials to be remembered, they can use their browser's built-in password manager, or an external password manager.

If the user wants their session to last longer, then increase the timeout on the authentication cookie.

What this question describes is a way to completely break the security of your application. You might as well not have any authentication in place at all!

1 solution

JavaScript
(function(exports) {
  "use strict";
 
  var XORCipher = {
    encode: function(key, data) {
      data = xor_encrypt(key, data);
      return b64_encode(data);
    },
    decode: function(key, data) {
      data = b64_decode(data);
      return xor_decrypt(key, data);
    }
  };
 
  var b64_table = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=";
 
  function b64_encode(data) {
    var o1, o2, o3, h1, h2, h3, h4, bits, r, i = 0, enc = "";
    if (!data) { return data; }
    do {
      o1 = data[i++];
      o2 = data[i++];
      o3 = data[i++];
      bits = o1 << 16 | o2 << 8 | o3;
      h1 = bits >> 18 & 0x3f;
      h2 = bits >> 12 & 0x3f;
      h3 = bits >> 6 & 0x3f;
      h4 = bits & 0x3f;
      enc += b64_table.charAt(h1) + b64_table.charAt(h2) + b64_table.charAt(h3) + b64_table.charAt(h4);
    } while (i < data.length);
    r = data.length % 3;
    return (r ? enc.slice(0, r - 3) : enc) + "===".slice(r || 3);
  }
 
  function b64_decode(data) {
    var o1, o2, o3, h1, h2, h3, h4, bits, i = 0, result = [];
    if (!data) { return data; }
    data += "";
    do {
      h1 = b64_table.indexOf(data.charAt(i++));
      h2 = b64_table.indexOf(data.charAt(i++));
      h3 = b64_table.indexOf(data.charAt(i++));
      h4 = b64_table.indexOf(data.charAt(i++));
      bits = h1 << 18 | h2 << 12 | h3 << 6 | h4;
      o1 = bits >> 16 & 0xff;
      o2 = bits >> 8 & 0xff;
      o3 = bits & 0xff;
      result.push(o1);
      if (h3 !== 64) {
        result.push(o2);
        if (h4 !== 64) {
          result.push(o3);
        }
      }
    } while (i < data.length);
    return result;
  }
 
  function keyCharAt(key, i) {
    return key.charCodeAt( Math.floor(i % key.length) );
  }
 
  function xor_encrypt(key, data) {
    return _.map(data, function(c, i) {
      return c.charCodeAt(0) ^ keyCharAt(key, i);
    });
  }
 
  function xor_decrypt(key, data) {
    return _.map(data, function(c, i) {
      return String.fromCharCode( c ^ keyCharAt(key, i) );
    }).join("");
  }
 
  exports.XORCipher = XORCipher;
 
})(this);


Calling function example:

C#
XORCipher.encode("test", "foobar");  
 XORCipher.decode("test", "EgocFhUX");  
 
Share this answer
 
v2

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900