ASP.NET MVC - Encrypt URL [duplicate]

Question

I'm developing a Web Site using ASP.NET MVC 3, Nowadays I need to encrypt the ID of my customer's URL. For example:

http://mysite.com/person?id=42

to something like that:

http://mysite.com/person?id=Dfjhasdfh33kASDG868365çkhg54sdSDFD

It need be secure. When I say secure, It means hard to any one discover the correct ID

Is there any library to do that?

Many secure web payments one of then like paypal uses this type of approach: https://paypal.com/br/webscr?info=CNS9tFsVM_tv4c18gHgZ3OMH2zblN7GWDQoyamVF3mzNh7vGDuhiKU3

Try this post, and hopfully it will answer your question stackoverflow.com/questions/6157150/… — Brian
– Brian, Commented Jun 14, 2012 at 16:40
What does this user id represent? Is it the current user? Why does it need to be secure? What could happen if it is not encrypted? — Darin Dimitrov
– Darin Dimitrov, Commented Jun 14, 2012 at 16:41
When I say secure, It means hard to any one discover the correct ID. — Michel Andrade
– Michel Andrade, Commented Jun 14, 2012 at 16:42
What makes your long ID any more secure than the number? This sounds like security through obscurity. — GWB
– GWB, Commented Jun 14, 2012 at 18:14

MikeSW · Accepted Answer · 2012-06-15 09:49:22Z

1

If you REALLY want to encrypt the query param, it's very simple, just use any encryptor provided by .Net and then use an attribute or a httpmodule to decrypt the param.

The most important thing is to ALWAYS validate the request. If you can do it a POST with anti forgery token, do it. Then, always check the user credentials if that user has access to the protected resource.

It's not hard at all, but you have to take it slowly and handle every scenario you can think of. Use a white list approach: only those who meet some conditions are allowed.

answered Jun 15, 2012 at 9:49

MikeSW

16.4k3 gold badges42 silver badges53 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Daniel A. White · Accepted Answer · 2012-06-14 17:01:55Z

1

One option would be to make your PK's that long with a randomly generated string or a unique identifier (GUID).

answered Jun 14, 2012 at 17:01

Daniel A. White

192k49 gold badges389 silver badges473 bronze badges

2 Comments

Michel Andrade Over a year ago

But to queries over those GUID will take long times.

moribvndvs Over a year ago

It is possible to generate GUIDs nowadays that are sequential and thus PK friendly. If sequential means that they are somewhat "predictable" and that's not acceptable, you could add a surrogate key column for this guid and use a non-clustered index.

Collectives™ on Stack Overflow

ASP.NET MVC - Encrypt URL [duplicate]

2 Answers 2

Comments

2 Comments

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

2 Comments

Linked

Related