How can you secure/encrypt your querystring in asp.net?

Question

Hi,

I was wondering how you could encrypt/decrypt your querystring in a simple asp.net page? some values need to be passed between different pages but the querystring cannot be changed or read.

Some say httphandles could be the solution for this.

Any thoughts?

MORE BACKGROUND INFO:

hi thx for all the comments. this is the problem, sometimes the sessions disappear without any reason (well there must be one but I don't know it yet). I've looked into the possible reasons but nothing that could cause it is happening. Therefore I cannot rely on it anymore. The cookie solution is a possibility but it will be more work to implement than simply using the querystring. The url can be copied at any time just not changed!

Cheers, M.

Answer 1

You'll have to encrypt it manually using one of the .Net encryptions. Really this isn't what the query string is for. If you don't want the users to be able to access it, you should find a different way of passing it between pages.

Here is a project that will show you how to do symmetric encryption. http://www.codeproject.com/KB/security/SimpleEncryption.aspx

Dare I mention this, because it will create significant overhead, but you can post your information in the view state and use cross page posts to pass the information around:

http://www.velocityreviews.com/forums/t119789-view-state-in-previous-page-using-cross-page-postback.html

Answer 2

How about adding the value you need to the Viewstate? Viewstate can encrypted and validated for you.

ViewState["myKey"] = "myValue";

and then later

string myValue = ViewState["myKey"]

To enable encryption:

<%@Page ViewStateEncryptionMode="Always" %>

or

<configuration>
   <system.web>
      <pages ViewStateEncryptionMode="Always" />
   </system.web>
</configuration>

Answer 3

Hi guys,

Thx for all the replies. I eventually went for the cookies solution.

Thx for the solution ChrisW

This will answer the question: http://www.semdendoncker.com/blog/?p=333

Cheers, M.