title: ASP Session Algorithm generate cookie via PHP
body: <p>I am writing a PHP script that needs to integrate with an ASP.NET login (which happens to be built on Sitecore, not sure if that matters).  I need to replicate the ability to generate/login/encrypt a session &amp; data cookie, and also detect if the user is logged in by detecting/decrypting a session &amp; data cookie.  Both the PHP &amp; ASP scripts can share the same MS SQL database and are on the same filesystem, so that's not an issue.  Most of my issues are just with setting/reading the ASP cookies within PHP.</p>
  
  <p>I have 2 cookies set by ASP.NET, </p>
  
  <p>ASP.NET_SessionId and .ASPXAUTH</p>
  
  <p>It is my belief that the ASP.NET_SessionId is for the session obviously and .ASPXAUTH is for the data.</p>
  
  <p><strong>My questions are:</strong></p>
  
  <ul>
  <li>It is my belief that in order to know if someone is logged in (or login someone in) via an ASP session, in PHP, I will need to compare the session data with the sessions stored on the filesystem, does anybody know where (or what determines where) these are located?</li>
  <li>Does anybody know the algorithm used to encrypt/decrypt the ASPXAUTH cookie?  <strong>I'm aware of the standard "Encrypt" and "Decrypt" methods, but I want to know the code that makes them run precisely.</strong>  IE is it first some sort of data array that is then salted and hashed?  Do the bytes of the output need to be shifted/converted?  If so, in what order/way?</li>
  </ul>
  
  <p>I appreciate any assistance, I will award an answer for the person that is the most helpful in answering either of these questions in the next few days.</p>
  
  <p>Currently I have been able to reproduce cookie generation via setcookie() in PHP.  That is, I can login via ASP.NET app, take the cookie data, plug it into the PHP app and logout via the ASP .NET app.  For those who are going to troll me, I am well aware this is possible and I do not NEED to explain why I am doing this, but it involves a lot of time, money and reasons, so yes, I do need to use BOTH PHP &amp; ASP.NET.</p>
  
  <p>THANKS!</p>
  
  <p><em>UPDATE</em></p>
  
  <p>I believe I was partially able to decrypt the cookie using this answer: <a href="https://stackoverflow.com/a/988018/775586">https://stackoverflow.com/a/988018/775586</a>   Anybody know how to finish it off? </p>