Question

I am working with a company who has a old web app running on .net 1.1

We are passing a critical information in the querystring, how can I hide just that parameter, the problem is, it is being sent from several hyperlinks, forms, response.redirects etc… I can’t use session either because it will be a huge change in the application, and right now we are not planning implement any major change.

So my question is, is there a way that I can encrypt/decrypt just that parameter from the querystring, probably at any event that asp page fires?

or maybe there is another of doing it?

Thanks,

Answer 1

This post contains code for an HttpModule which decrypts an entire query string: (encrypt and decrypt query string) and then rewrites the path enabling the pages in application to pull the decrypted params.

You could modify the HttpModule to look for a single parameter and decrypt that.

After decryption you could rebuild the query using the decrypted param along with the rest of the original query and rewrite the path using it.