Using crypto-js node modules in Apigee Javascript policy

[sushobhanmonda1]

I'm trying to use the crypto-js node module in a JS policy and following this example. What is the best way to create the crypto-js.js file included in this example and to ensure that the file has updated code and is safe to use? Here's the repo for the module, and it looks like source code has been updated as recently as 4 months ago; so how do I ensure that the crypto-js.js file I use has the latest code?

[dchiesa1 · Accepted solution]

I wouldn't do that.

Despite the existence of the example you cited, the JS callout is not well-suited to performing crypto. It's better to do that kind of work in Java.

What specifically are you trying to do?

[sushobhanmonda1]

Hi @Dino-at-Google - I'm trying to encrypt json payload in Apigee as well as decrypt responses received from backend using PBKDF2 function supported by crypto-js and AES algorithm. I understand it might be possible to do this in a Java callout as well but it seems like much less work if I can use the crypto-js module and have my logic in a javascript. I don't have strict performance requirements, however, I need to ensure any 3rd party code in my proxy is from reliable source.

[dchiesa1]

Yes, it's less work I guess if you are handy with JavaScript.

The crypto-js README doesn't describe it, but it has a package.json file with the details. The build is set up with "grunt". And the build output is the .js source that you would need to include in your proxy.

So the first step is to clone the repo.

Then, the way you would build it is:

1. cd into the directory containing the cloned repo
2. npm install

   This installs grunt, and a bunch of other dependencies.

3. npm run-script build

   This builds (bundles) the code.

   This step stores the output (the bundle) in the build/ directory. The crypto-js.js file is the one you want.

I haven't tested the crypto-js.js file that gets generated by this build, with the latest Apigee. But these ARE the steps to produce the output bundled fie.

[dchiesa1]

See also, this repo, which performs AES crypto, potentially using a key derived via PBKDF2.

https://github.com/DinoChiesa/Apigee-CustomPolicy-AesCrypto

[sushobhanmonda1]

Thanks a lot. Those steps worked to get me the crypto-js.js file. I also acknowledge your idea of using Java for crypto functions in Apigee instead of JavaScript. Although it is far easier to build and troubleshoot in JavaScript, I found out that for at least this algorithm, JS takes almost 10 times more to encrypt and decrypt same payload than Java does (I know I said no "strict performance requirement" .. but wasn't really expecting 1 sec vs 10 sec).

[dchiesa1]

Yes, that's my experience as well. The JS in Apigee does not run in v8, does not enjoy all the performance benefits that we've all seen with v8 over the past years.

[GiovanniGiorno7]

HUUUGE thanks for your help, guys! I highly appreciate it!! Tbh, I’ve been bothered by this issue for more than a week. So, I guess I’m lucky today to finally find the solution! Btw, guys, I’d like to ask for your help with another issue. I can’t find where to download mt5 for pc, so I’d be very grateful for your help. I want to start trading, so my friend advised me to install the 5th version of MetaTrader, but I can’t find it. I’m sorry if it’s not related to this thread. Still, I’d highly appreciate your help or advice!!! TIA!!

[dchiesa1]

Hey Giovanni, I'm glad you found this helpful.  This thread has been out there for... about 18 months.  
You said you have been bothered by this issue for more than a week.  Were you not able to find this thread by searching?   Or... maybe you hadn't thought to search? 

Also, specifically what sort of crypto were you looking to do? 

[bhupendergiri]

crypto.dateFormat('yyyy-MM-DD HH:mm:ss','EST') gave me 

>2023-10-283 15:45:39 instead of 

>2023-10-283 16:45:39