Using Ampscript DecryptSymmetric function within SSJS

Question

I am trying to get access token using SSJS, but to retrieve client id and client secret I want to use an ampscript function - DecryptSymmetric.

When I use this function I get '500 - Internal server error'.

<script runat="server">
  
    var fullToken = getToken()

function ampScript(code) {
    var ampBlock = '\%\%[' + code + ']\%\%';
    Platform.Function.TreatAsContent(ampBlock);
    return Variable.GetValue('@response');
};

    function getToken(){

       var clientId = ampScript("SET @response = DecryptSymmetric('enctryptedClientId', 'AES','symmetricKeyValue', @null,'saltKeyValue', @null, 'InitializationVectorKeyValue', @null");
       
       var clientSecret = ampScript("SET @response = DecryptSymmetric('enctryptedClientSecret', 'AES','symmetricKeyValue', @null,'saltKeyValue', @null, 'InitializationVectorKeyValue', @null");

          
        var authEndpoint = 'xyz.auth.marketingcloudapis.com';
        var payload = {
                client_id: clientId,
                client_secret: clientSecret,
                grant_type: "client_credentials"
            };
        var url = authEndpoint + '/v2/token';  
        var contentType = 'application/json';

        var accessTokenRequest = HTTP.Post(url, contentType, Stringify(payload));
        if(accessTokenRequest.StatusCode == 200) {
                var accessToken = Platform.Function.ParseJSON(accessTokenRequest["Response"][0]).access_token;
                
        var token = 'Bearer ' + accessToken;
        
        }
        return token; 
    }
    </script>

Answer 1

nasty little thing: symmetricKeyValue etc - If these are hardcoded, plain password, salt and IV, which it looks like, then the order of the arguments in the function is different.

try it like so:

/* plain key params as variable */ 
SET @pw = "XYXYYXY"
SET @salt = "XXXXXXXXXXXXXXXX"
SET @IV = "XXXXXXXXXXXXXXXXXXXXXXXXXXXXX"

/* decryption, note change in @null / variable order */
SET @clientId = DecryptSymmetric(@clientIdEncrypted, 'AES', @null, @pw, @null, @salt, @null, @iv)
SET @clientSecret = DecryptSymmetric(@clientSecretEncrypted, 'AES', @null, @pw, @null, @salt, @null, @iv)

The order in your code were correct if you referenced key management params by their external Keys. But with passwords physically in your code, the above is the right order (@nulls first).