URL with unprintable characters

Question

What are some of the ways a url can be displayed in a browser control within a desktop and not allowing users to be able to get the url and enter it into a browser. Basically anyone who has the desktop app gets the app which the url points to for free but want to prevent users from using the url outside the context of the desktop app.

Is using unprintable characters in the url an option? Or will that cause bigger headaches in the urls parsing in the browser and the server? The solution doesn't have to be totally foolproof as long as the average Joe cannot get to it.

Answer 1

If someone getting ahold of the URL undermines the security of your entire application you have a problem elsewhere. Perhaps check upon rendering of the page if the user is allowed to see it or not?

Answer 2

Can you add some kind of custom HTTP headers through the browser control? Or check the user-agent header that already gets sent by the browser control...either of those may allow your server-side code to render or not render the page.