How can I make a query string tamper-proof?

Question

I need to use query strings in a URL, but need to ensure that they haven't been tampered with. I found a solution which almost works, but the encoded strings get mangled by a service my app needs to use. Can anyone think of a different solution?

EDIT: The solution I mention doesn't work for me because the Base64 encoded query string it produces contains "+". The service I pass this query string to doesn't properly handle "+", and I can't even URL encode it to "%2B". I can substitute "_" for it, I suppose. However, I was wondering if there was a different solution entirely.

EDIT 2: To be more clear, the solution I reference works, but I was wondering about alternative solutions.

Answer 1

Basically a duplicate of: http://stackoverflow.com/questions/245569/security-with-querystring-values-in-asp-net-mvc

Bottom line - never trust input from the user especially over the web, always assume a user can and will tamper with the inputs.

Answer 2

you can encrypt your querystring value and then pass it and where you want to use, simply decrypt it. Also check these articles... how-to-encrypt-query-string-parameters-in-asp-net

http://www.codeproject.com/KB/web-security/QueryStringEncryptionNET.aspx

Answer 3

Short answer: you can't ensure that the querystring has not been tampered with. You need to validate whatever the querystring might happen to be, verify that it is in the correct format and make sure the user making the GET request has appropriate permissions.