var url = "DocumentId="+DocumentID+"&SectionType=1&RecID="+RecipientID;
window.open ( "../EBox/ShowLetter.aspx?Url="+encodeURIComponent(url),'PrintMail' , features );
Instead of encoding I want ot encrypt the url . What is the solution for this?
-
3If it has to be secure, javascript is the wrong place to go. Anything done in javascript will be visible to a hacker, who will easily get an encrypted string.nebkat– nebkat2011-01-06 12:08:59 +00:00Commented Jan 6, 2011 at 12:08
-
@Neb, you should post your comment as answer because this is the answer to this question.Darin Dimitrov– Darin Dimitrov2011-01-06 12:10:11 +00:00Commented Jan 6, 2011 at 12:10
-
its not true - the algorithm you use to encrypt needs to be secure, not that the source code is visible.Chii– Chii2011-01-06 12:17:22 +00:00Commented Jan 6, 2011 at 12:17
-
@Chii, and could you explain which is this secure algorithm? All of them require keys, pass phrases, certificates, initialization vectors which need to be stored somewhere. Where would you store them in case of javascript?Darin Dimitrov– Darin Dimitrov2011-01-06 12:24:11 +00:00Commented Jan 6, 2011 at 12:24
-
Anything that can be decrypted is insecure when you have source code from javascript. Obviously, there is nothing 100% secure over the internet, but you just have to settle for some level of security.nebkat– nebkat2011-01-06 13:23:51 +00:00Commented Jan 6, 2011 at 13:23
|
Show 1 more comment
2 Answers
If it has to be secure, javascript is the wrong place to go. Anything done in javascript will be visible to a hacker, who will easily get an encrypted string.
2 Comments
Darin Dimitrov
+1, that's exactly how it is.
Use HTTP with SSL (HTTPS). Everything sent between the client and the server (including the URL in the HTTP GET request) will be encrypted.
Obviously, this won't hide the data from the user, but since it starts in unencrypted form in the browser (the data you were planning to input into the JS encryption routine), nothing will.
