Re: Hiding the query string in ASP.NET

yes... it is the server that would use the encrypted value, not the client.
the client wouldn't encrypt it the server would, since you are just clicking
a link. the server would encrypt, the link would exist in the page.. then
they click on it.. it goes back to server and server decrypts to figure what
they want to see.
I'd highly recommend a guid instead of the direct id on the querystring if
you cant link information to a specific login. Add a new column to the table
or track it in another table, etc.


On Wed, Nov 5, 2008 at 3:36 PM, John Warner <[email protected]> wrote:

> Isn't a hash ect limited to the server? Any other encryption on the client
> would have to be JavaScript which the 'savvy' user could figure out? Would
> this not be the case? Note I'm asking here as this thread has been
> interesting to read and learn from.
>
> John Warner
>
>
> > -----Original Message-----
> > From: Discussion of advanced .NET topics. [mailto:ADVANCED-
> > [email protected]] On Behalf Of Christoffer Skjoldborg
> > Sent: Wednesday, November 05, 2008 6:11 PM
> > To: [email protected]
> > Subject: Re: [ADVANCED-DOTNET] Hiding the query string in ASP.NET
> >
> > A more secure option would be to hash and/or encrypt the ids used in
> query
> > strings (or ids present client-side in general). Remember to
> > UrlEncode/Decode as well if you do so.
> >
> > /Chris
> >
> >
> > On Wed, Nov 5, 2008 at 11:16 PM, Clark, Michael (OFM) <
> > [email protected]> wrote:
> >
> > > This may or may not be a .NET related question, but I really don't
> know
> > > for sure, so...
> > >
> > > In our application we pass some data from one page to another using
> > > other user cookies (not browser cookies), and we also have been
> passing
> > > some information via the querystring.  For example, a reimbursement
> > > request id appearing in the querystring as
> > >
> > > ViewReimbursementRequest.aspx?request_id=324
> > >
> > > Well, this works great except that if a user happens to know the
> > > reimbursement request number of a request belonging to another user,
> he
> > > could edit the query string to be able to look at that request.  We
> > > would like to limit this capability, and I recall having heard there
> was
> > > a way to suppress the querystring part after the page name, and still
> be
> > > able to pass the querystring.  I'm not talking about using POST, or
> > > about embedding the relevant data as a cookie, or in a session
> variable.
> > > I remember hearing about this capability in a presentation I heard
> about
> > > eight or nine years ago, as a new capability of Windows Server 2000 or
> > > NT.  But I don't know if it was a server option or setting or
> something
> > > that could be set within an application.
> > >
> > > ===================================
> > > View archives and manage your subscription(s) at
> > > http://peach.ease.lsoft.com/archives
> > >
> >
> > ===================================
> > View archives and manage your subscription(s) at
> > http://peach.ease.lsoft.com/archives
>
> ===================================
> View archives and manage your subscription(s) at
> http://peach.ease.lsoft.com/archives
>

===================================
View archives and manage your subscription(s) at http://peach.ease.lsoft.com/archives