如何解码Firefox localStorage中存储的access_token值

API 探路者

2026-6-22

解码Firefox localStorage中的access_token值

我在Linux Alpine系统上尝试解码Firefox localStorage中存储的值。Firefox将localStorage数据存储在/config/.mozilla/firefox/*.default-release/storage/default/<website>/ls/data.sqlite路径下。通过命令sqlite3 data.sqlite "SELECT value FROM data WHERE key = 'access_token';"提取加密的access_token值后，得到如下字符串：

��eyJhbGcisdiJSUzI1NiIsInRsdIgOiAiSldUIiwia2lkIiA6ICJsdkdsSnR6RjRxXzdrdWhSc29VTUNrM2k1dGVNMU1EM\h0dHBzOi8vcHJvY29uLWsdnN1bWlkb3ItcHJvZC5henVyZXdlYnNpdGVzLm5ldCIsImh0dHBzOi8vcHJvY29uLWZvcm5lY2 ��yaG1sLmF6dXJld2Vic2l0ZXMubmV0L2F1dGhlbnRpY2F0aW9uL2xvZ2luLWNhbGxiYWNrIiwiaHR0cHM6Ly9icGNvbnN1bsdkb3JwcmQuY2JseC5kZXYiLCJodHq$.,

根据资料，Firefox使用Snappy算法压缩该值。但将提取的值保存到文件后，使用python-snappy库解压时出现如下错误：

>>> snappy.uncompress(file.read())
Traceback (most recent call last):
  File "/Users/abc/.pyenv/versions/cde/lib/python3.11/site-packages/snappy/snappy.py", line 84, in uncompress
    out = bytes(_uncompress(data))
                ^^^^^^^^^^^^^^^^^
cramjam.DecompressionError: snappy: input buffer (size = 446315786887151) is larger than allowed (size = 4294967295)

The above exception was the direct cause of the following exception:

Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/Users/cde/.pyenv/versions/abc/lib/python3.11/site-packages/snappy/snappy.py", line 86, in uncompress
    raise UncompressError from err
snappy.snappy.UncompressError

请问如何提取localStorage中保存的access_token值，使其格式与浏览器中显示的一致？

解决方案

问题根源：直接用sqlite3默认文本输出提取的字符串经过了转义（比如\h这类字符），且开头的二进制标识被转成乱码，导致python-snappy无法识别正确的Snappy压缩格式。
正确操作步骤：
1. 二进制方式导出原始数据：使用sqlite3的.mode blob命令导出未转义的二进制数据，避免文本转义破坏原始格式：
```
sqlite3 data.sqlite ".mode blob" "SELECT value FROM data WHERE key = 'access_token';" > access_token.bin
```
2. 跳过头部标识后解压：Firefox会在Snappy压缩数据前添加2字节的标识（0x00 0x01），读取二进制文件时需跳过这部分再解压：
```
import snappy

with open('access_token.bin', 'rb') as f:
    compressed_data = f.read()
    decompressed_token = snappy.uncompress(compressed_data[2:]).decode('utf-8')
    print(decompressed_token)
```
3. 验证结果：输出的字符串应与浏览器开发者工具中localStorage内的access_token值完全一致。
补充说明：如果直接用文本方式提取，sqlite3会自动转义二进制特殊字符，同时二进制头部会变成乱码，这两种情况都会导致解压失败，必须用二进制导出方式获取原始数据。

内容的提问来源于stack exchange，提问作者Kafka4PresidentNow