Re: Hiding the query string in ASP.NET

using a guid as a new or side by side key is not an option?


On Thu, Nov 6, 2008 at 5:33 PM, Clark, Michael (OFM) <
[email protected]> wrote:

> Trying to recall.  It was at a Seattle VB users group meeting (used to
> be, its now .Net Developers Association) and one of the then big
> developers (don't remember the name) at 15seconds.com made a
> presentation in which he said something to the effect of what I said in
> my question.  Problem is, I may have misunderstood at the time, or over
> the years it might have grown into a misunderstanding.  I have no way to
> tell.  But after a great deal of research (including many of the
> responses on this list, thanks everybody) it appears that my
> understanding was flawed.
>
> I have no problem with POST, but in this case we are building the url
> string from responses and information gotten from a database.  User
> enters data or makes a selection and the result is something like:
>
> Response.Redirect("~/thePage.aspx?rid=" +
> SomeMethodThatGetsTheID(fromUserInput));
>
> So, we will have to do something else than what I was trying find out
> how to do.  Encrypt the querystring, put it into user cookies, or
> session variables.
>
> -----Original Message-----
> From: Discussion of advanced .NET topics.
> [mailto:[email protected]] On Behalf Of Pardee, Roy
> Sent: Thursday, November 06, 2008 12:35 PM
> To: [email protected]
> Subject: Re: [ADVANCED-DOTNET] Hiding the query string in ASP.NET
>
> Are you actually opposed to using POST, or are you just trying to recall
> what this new tech was?
>
> -----Original Message-----
> From: Discussion of advanced .NET topics.
> [mailto:[email protected]] On Behalf Of Clark,
> Michael (OFM)
> Sent: Wednesday, November 05, 2008 2:17 PM
> To: [email protected]
> Subject: [ADVANCED-DOTNET] Hiding the query string in ASP.NET
>
> This may or may not be a .NET related question, but I really don't know
> for sure, so...
>
> In our application we pass some data from one page to another using
> other user cookies (not browser cookies), and we also have been passing
> some information via the querystring.  For example, a reimbursement
> request id appearing in the querystring as
>
> ViewReimbursementRequest.aspx?request_id=324
>
> Well, this works great except that if a user happens to know the
> reimbursement request number of a request belonging to another user, he
> could edit the query string to be able to look at that request.  We
> would like to limit this capability, and I recall having heard there was
> a way to suppress the querystring part after the page name, and still be
> able to pass the querystring.  I'm not talking about using POST, or
> about embedding the relevant data as a cookie, or in a session variable.
> I remember hearing about this capability in a presentation I heard about
> eight or nine years ago, as a new capability of Windows Server 2000 or
> NT.  But I don't know if it was a server option or setting or something
> that could be set within an application.
>
> ===================================
> View archives and manage your subscription(s) at
> http://peach.ease.lsoft.com/archives
>
> ===================================
> View archives and manage your subscription(s) at
> http://peach.ease.lsoft.com/archives
>
> ===================================
> View archives and manage your subscription(s) at
> http://peach.ease.lsoft.com/archives
>

===================================
View archives and manage your subscription(s) at http://peach.ease.lsoft.com/archives