How to encrypt with JavaScript and then decrypt with C#

Question

I'm working with ASP.NET MVC4 and here is what i want to do:

I have a Web API that Gets a username, a password and a serial number and return a JSON file with the required data. But as a matter of security, passwords should not figure that clear in the URL, so I changed its implementation into a Web API that gets an encrypted string, that will be decrypted later to extract the three fields.

The problem is when working with a view that calls this Web API, I should encrypt the text fields entered by the user using JavaScript, right? So this encryption with JavaScript should correspond to the decryption method written in C#. Is there any existing way to do that ? Or should I consider this problem differently?

And what will happen when user will disable the javascript on his browser? The easiest path would be to use the ssl and a POST request instead of get (assuming you have control over the webapi) — Gaurav Pandey
– Gaurav Pandey, Commented Feb 15, 2013 at 8:56
This sounds like a bad idea, the URL is a highly visible item and no amount of encryption of credentials is going to help. If you're going down this route, why not enable HTTPS and use one of the existing HTTP authentication schemes? I believe basic digest authentication uses base64 to encode username and password, but I think that's just to ensure everything is in ASCII. Have a look at this cheatsheet for authentication: owasp.org/index.php/Authentication_Cheat_Sheet — booyaa
– booyaa, Commented Feb 15, 2013 at 9:07

Cerbrus · Accepted Answer · 2013-02-15 09:00:38Z

4

Just use a secure connection (https:// ssl).

Any encryption you can do in JavaScript can be reversed, since the code used to encrypt the data is available to anyone that uses it, and can easily be reverse-engineered.

answered Feb 15, 2013 at 9:00

Cerbrus

73.3k19 gold badges138 silver badges151 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

mahoosh Over a year ago

SSl is for sure the ultimate way for secure connections, but let's suppose that i can't afford that now, isn't there any other alternatives that could garanty a minimum of security?

Cerbrus Over a year ago

@mahoosh: The problem is that anything you can do with JS can be undone without too much effort. At least use POST requests instead of GET's, and maybe md5 whatever data you can (Compare a md5'd password with a md5 value, server-side. That way you're never transmitting the actual PW)

mahoosh Over a year ago

So if i opt for this Post option, i will have to parse the Json file resulted and display it into an html page. Is there any way that i allows me to return the Json file directly just like the get responce ? (Im sorry if my questions are not that devolleped, im still new to the Web api thing)

Collectives™ on Stack Overflow

How to encrypt with JavaScript and then decrypt with C#

1 Answer 1

3 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

3 Comments

Your Answer

Sign up or log in

Post as a guest

Related