Re: Hiding the query string in ASP.NET

Trying to recall.  It was at a Seattle VB users group meeting (used to
be, its now .Net Developers Association) and one of the then big
developers (don't remember the name) at 15seconds.com made a
presentation in which he said something to the effect of what I said in
my question.  Problem is, I may have misunderstood at the time, or over
the years it might have grown into a misunderstanding.  I have no way to
tell.  But after a great deal of research (including many of the
responses on this list, thanks everybody) it appears that my
understanding was flawed.

I have no problem with POST, but in this case we are building the url
string from responses and information gotten from a database.  User
enters data or makes a selection and the result is something like:

Response.Redirect("~/thePage.aspx?rid=" +
SomeMethodThatGetsTheID(fromUserInput));

So, we will have to do something else than what I was trying find out
how to do.  Encrypt the querystring, put it into user cookies, or
session variables.

-----Original Message-----
From: Discussion of advanced .NET topics.
[mailto:[email protected]] On Behalf Of Pardee, Roy
Sent: Thursday, November 06, 2008 12:35 PM
To: [email protected]
Subject: Re: [ADVANCED-DOTNET] Hiding the query string in ASP.NET

Are you actually opposed to using POST, or are you just trying to recall
what this new tech was?

-----Original Message-----
From: Discussion of advanced .NET topics.
[mailto:[email protected]] On Behalf Of Clark,
Michael (OFM)
Sent: Wednesday, November 05, 2008 2:17 PM
To: [email protected]
Subject: [ADVANCED-DOTNET] Hiding the query string in ASP.NET

This may or may not be a .NET related question, but I really don't know
for sure, so...

In our application we pass some data from one page to another using
other user cookies (not browser cookies), and we also have been passing
some information via the querystring.  For example, a reimbursement
request id appearing in the querystring as

ViewReimbursementRequest.aspx?request_id=324

Well, this works great except that if a user happens to know the
reimbursement request number of a request belonging to another user, he
could edit the query string to be able to look at that request.  We
would like to limit this capability, and I recall having heard there was
a way to suppress the querystring part after the page name, and still be
able to pass the querystring.  I'm not talking about using POST, or
about embedding the relevant data as a cookie, or in a session variable.
I remember hearing about this capability in a presentation I heard about
eight or nine years ago, as a new capability of Windows Server 2000 or
NT.  But I don't know if it was a server option or setting or something
that could be set within an application.

===================================
View archives and manage your subscription(s) at
http://peach.ease.lsoft.com/archives

===================================
View archives and manage your subscription(s) at
http://peach.ease.lsoft.com/archives

===================================
View archives and manage your subscription(s) at http://peach.ease.lsoft.com/archives