Hide url routing parameters in asp.net mvc

Question

Is there a method for specifically hiding the routing parameters in ASP.NET MVC from the users. Specifically, I'd like a link

http://sitename.com/Do?title = 2 to simply become http://sitename.com/Do

but internally pass the titleId to my controller.

Is that do able?

Thanks

Update: yes, there are buttons on my webpage that currently have such as their href, but I'd rather hide all the parameters so users dont go to other parts of the page directly by trying differnt parameters. @Moshe, no its not a from submit or post else I'd have used a strongly typed view. Thanks

I'll add to the comment made by Emmanuel - is "Do" an action invoked using a form submit? specifically using the POST method? — Moshe
– Moshe, Commented Jan 19, 2012 at 15:50
Could you expound upon "hide"? Do you not want it in the URL, or do you not want it transmitted over the wire at all? — Aaron Daniels
– Aaron Daniels, Commented Jan 19, 2012 at 19:07
@Aaron, I dont want the parameters in the URL to be visible to the users but it needs to be transmitted to my controller..hence the hiding the parameters from the user — Tunji Adeloye
– Tunji Adeloye, Commented Jan 19, 2012 at 20:45
One option is to encode/decode the querystring in some way, but do I understand correctly that you are after a clean looking URL? In that case an option is to transmit your request and update the page asynchronously. — jkokorian
– jkokorian, Commented Jan 19, 2012 at 21:05

slfan · Accepted Answer · 2012-01-20 20:32:11Z

2

As long as your parameters are on the client, they are never 'hidden' unless you encrypt them. You could store the parameter in a hidden field and set the action method to post, then the value is not visible in the URL. But a user with a little bit of knowlegde about web could still manipulate the hidden field (unless you encrypt the value in some way).

EDIT: If it has to be save you have to check the user's credentials on the server. Otherwise you can obscure the data like in the other sample or you can use encryption, e.g. with ProtectData.Protect(...).

edited Jan 20, 2012 at 20:32

answered Jan 19, 2012 at 21:20

slfan

9,129115 gold badges69 silver badges81 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Tunji Adeloye Over a year ago

OK. I will see how i can encrypt the values. any idea how i can encrypt the values?

slfan Over a year ago

If you just want to keep nosy users away, you could encode (or obscure) your data. But this is not very safe as it can easily be guessed. An easy way to encrypt would be ProtectedData.Protect(..), but you have to decrypt the values on the same machine (not suitable for farms).

Community · Accepted Answer · 2017-05-23 11:52:08Z

0

For simple numeric values that have to be passed back and forth to a view you can write two private methods in your controller:

private int Obscure(int source) {
    return (source*source) * 3; //or something clever you come up with
}

private int DeObscure(int obscuredValue) {
    return (int)Math.Sqrt(obscuredValue / 3); //inverse the Obscure method
}

You can use these to obscure values before you pass them to a view, and de-obscure them after you get them posted back. Mind you, this is really not a good way to implement security, as is explained in this stackoverflow post.

Another option is to create an Obscure/DeObscure procedure that takes in the entire querystring and somehow mangles that back and forth. This would required writing a custom ViewEngine though. Sounds interesting...

edited May 23, 2017 at 11:52

CommunityBot

11 silver badge

answered Jan 20, 2012 at 7:19

jkokorian

3,1157 gold badges36 silver badges49 bronze badges

Collectives™ on Stack Overflow

Hide url routing parameters in asp.net mvc

2 Answers 2

2 Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

2 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related