How to hide parameters/query-strings from URL?

Question

I am trying to remove parameters from URL to make user friendly URL and to optimize URL for Search Engine optimization.

I have written below code in startup.cs

 routes.MapRoute(
                    name: "edit-project-route",
                    template: "manage-your-project/{id?}",
                    defaults: new { controller = "Manager", action = "EditProject" 
});

Edit Button is there in detail page as shown below:

Here is code of above page:

        @foreach (var item in Model)
        {
            count = count + 1;
            <tr>
                <td scope="row">@count</td>
                <td>@Html.DisplayFor(modelItem => item.Name)</td>
                <td>@Html.DisplayFor(modelItem => item.Technology)</td>
                <td>                    
                    <a href="/manage-your-project/@item.ProjectId" class="btn btn-sm btn-primary">Edit</a>
                    <a href="@Url.Action("DeleteProject",new { id=item.ProjectId})" class="btn btn-sm btn-danger">Delete</a>
                </td>
            </tr>
        }

Whenever I click on edit button, Below page is displayed in browser.

I want to remove highlighted ID from query string. Is there any way to achieve this by not affecting functionalities.

In general: no, how else is the browser going to tell the server what the ID is? There are two (ugly) ways to escape this: (i) use a <form> with POST, but that goes against all modern ways of working and has its own disadvantages, or (ii) set a cookie and then read in on the server, but what cookie value is being used if the user has two tabs open that should have different IDs? So again: no. — Peter B
– Peter B, Commented Mar 30, 2018 at 7:01
I know that you can modify url clientside with history.pushState(); But this also removes the possibilty for the user to save the page as bookmark. Probably also if you change it then @PeterB answer will apply so... probably a no still.. — H.Mikhaeljan
– H.Mikhaeljan, Commented Mar 30, 2018 at 7:02
@ChetanRanpariya Here 2 is primary key...If someone changes it and apply any other input i.e 5 ..then it will redirect to edit page of that id ..That's why i want to remove it from url — Techno Crave
– Techno Crave, Commented Mar 30, 2018 at 7:02
@TechnoCrave if that user is not allowed on PK 5. Then do a check on the load and check if the user has permissions. Removing plain url is probably a bad solution. Meaning if he manually types the PK in it will still work so a bad solution. — H.Mikhaeljan
– H.Mikhaeljan, Commented Mar 30, 2018 at 7:08

Mitchel Sellers · Accepted Answer · 2018-03-30 07:12:00Z

If you want to get rid of the ID, you will need to lookup on your own a way to validate the functionality in more detail. We do this at times with blog posts, or otherwise. An example might be a route config like this.

routes.MapRoute(
     "Manage-Account",
     "manage/{projectName}",
      new {action = "EditProject", controller="Manager"}
  );

You could then have a method of your code that works like this

public IActionResult EditProject(string projectName){
    //TODO: Lookup the project, using the name, and display result
}

You could then get URLs such as

/Manage/My-Project or /Manage/Other-Project-Title

You can get a bit more advanced with this to remove the /manage/ part from this example, but often you have other consequences to understand.

Edit: Based on comments, your desire here is to improve security, which isn't going to be addressed by this solution. If a user only has edit rights to a specific value (Example id 1, but not 5) you want to validate this on both the GET and POST actions for editing to ensure that users are not manipulating the URL, this would go with friendly URL structures or otherwise.

Collectives™ on Stack Overflow

How to hide parameters/query-strings from URL?

1 Answer 1

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related