How to encrypt query strings in aspx.net?

Question

Title I hope says it all: How do I encrypt query strings in aspx.net?

P.S. I realize that this does not offer security. I'm just looking to obfuscate a puzzle.

P.P.S Though I marked CKret's answer as the correct one (for the question as worded I believe his is the most correct answer). However, for myself, I'm just going to try ChoasPandion's alternative to encryption. If I needed more security I'd look at CKret's or Ian's. Thank you all.

Answer 1

A blog post by Mads Kristensen about Query String encryption.

Beware of one thing though: He uses PasswordDeriveBytes within the Encrypt method. It has been replaced by Rfc2898DeriveBytes. If you only need to encrypt the query string and not every link on the page this is fine. If you however want to encrypt every link too you'll want to add a Rewriter to encrypt those query string too.

Doing so will have a substantial impact on performance if you have many links on your pages. What you would want to do is lift out the PasswordDeriveBytes/Rfc2898DeriveBytes from the encrypt/decrypt methods and store the key and IV instead of the password and salt.

Edit:
I've published a blog post on this issue here.

Answer 2

Don't bother encrypting it. Just convert it to a base 64 string.

string encoded = Convert.ToBase64String(Encoding.Unicode.GetBytes(myQueryStringValue));

Answer 3

If you trying to hide your product Id's and things like that, then why not just use Encryption?

I guess what you want to do, is to stop people editing the query string to get different results. The simple way to do this, is to add a Hash of the query string to the query string, and have some base-page functionality check that the hash is correct for the request, identifing tampered query strings.

See Prevent query string manipulation by adding a hash?