Question

i call my asp.net page method like below code

 $.ajax({
        type: "POST",
        url: "MyPage.aspx/GetItems",
        data: "{'ID':'1', 'Name':'Keith'}",
        contentType: "application/json; charset=utf-8",
        dataType: "json",
        success: function (data) {
           // my success code
        }
    });

the above way i call my asp.net pagemethod using jquery. so if anyone see the page source then he can see what page i am calling and what values i am passing. so anyone can call my page same way and get the data.

so here i need to incorporate some tokenid which i will generate at runtime and will pass to server side function. in this case again user can see the tokenid but if he copy my tokenid then that tokenid will not work for him. so i just need logic to generate dynamic tokenid which will be valid only form my web apps.

please share the logic.

Answer 1

I do this way:

1. server side: create session variable that store Dictonary<‘tokenid’, ‘context’>
2. client side: use only tokenid

TokenId be generated via Guid.NewGuid or RNGCryptoServiceProvider.
Context – is some data associating with token (in your case it’s ‘ID’).

Thereby

• we never send real ids to client side
• tokenid is randomness and unrepeatable
• user cannot get access to general data