Question

I have a dictionary object which i would like to encrypt, then put it in a querystring, then decrypt it on the other side.

I’m using JavaScriptSerializer for this. Now i’ve tried this on the same page onload, and it worked. So the encrypt/decrypt extension methods im using are working. This leads me to believe there’s some issue going on with the querystring.

e.g.

        var js = new JavaScriptSerializer();
        var d = new Dictionary<string, string>();
        d.Add("ID", "123456");
        d.Add("Name", "HELLO TEST");
        d.Add("Email", "[e-mail]");
        var s = js.Serialize(d).EncryptString();
        var ds = js.Deserialize<Dictionary<string, string>>(s.DecryptString());
        @ViewBag.Test = ds["Name"];

In the above example, EncryptString() and DecryptString() are the extension methods i’m using. This works as intended, so it pulls the correct value for "Name".

I run into problems when I put the serialized encrypted string into the querystring then try and decode it.

So on the first page, i have something like this:

        var js = new JavaScriptSerializer();
        var d = new Dictionary<string, string>();
        d.Add("ID", "123456");
        d.Add("Name", "HELLO TEST");
        d.Add("Email", "[e-mail]");
        var s = HttpUtility.UrlEncode(js.Serialize(d).EncryptString());

s is then used as the querystring.

On the receiving page, i have this:

public ActionResult Display(string r)
{
        var js = new JavaScriptSerializer();
        var decryptedString = HttpUtility.UrlDecode(r).DecryptString();
        var s = js.Deserialize<Dictionary<string, string>>(decryptedString);
        return View();
}

This throws an error: System.FormatException: Invalid length for a Base-64 char array or string. This errors on the decryptstring line.

I don’t get what’s going on… I’m urlencoding the text before it goes into the querystring, then urldecoding it before it’s deserialized..

EDIT

Figured it out.. I was encrypting it twice…

Answer 1

Chances are that you don’t need to UrlDecode your string, because MVC will have done that before assigning the value of your r parameter. Try decrypting r directly.

And of course, I have to issue the warning: what you’re doing here seems like a very bad idea. Whatever you’re trying to accomplish by sending this encrypted dictionary in the URL, there is almost certainly a better way to accomplish it.