https://blog.margrop.net/en/tag/webapi/ Recent content in WebAPI on Margrop Blog Hugo -- gohugo.io en-US Sat, 11 Jul 2026 08:30:00 +0800 https://blog.margrop.net/en/post/synology-webapi-login-encryption-deep-dive/ Sat, 11 Jul 2026 08:30:00 +0800 https://blog.margrop.net/en/post/synology-webapi-login-encryption-deep-dive/ <blockquote> <p><strong>The short version</strong></p> <p>Some Synology WebAPI clients do more than post <code>account</code> and <code>passwd</code> to <code>auth.cgi</code>. The implementation preserved in OpenStack Cinder first calls <code>SYNO.API.Encryption.getinfo</code>, receives an RSA public modulus, server time, and two dynamic field names, then generates a one-use passphrase. RSA PKCS#1 v1.5 encrypts that passphrase; an OpenSSL-compatible AES-256-CBC envelope encrypts the URL-encoded login parameters; both Base64 values are finally placed inside the server-provided <code>cipherkey</code> field.</p> <p>This is an authorized WebAPI compatibility technique—not a password bypass. A SID for <code>session=DSM</code> is also not automatically the same thing as a complete browser UI login state. Parameter encryption does not replace HTTPS, because TLS still authenticates the server and protects integrity against an active intermediary.</p> </blockquote> <p><img alt="Original cover: an RSA outer envelope and AES inner envelope protect a NAS login" src="https://blog.margrop.net/post-images/synology-webapi-login-encryption-deep-dive/00-cover-original.png"></p>