Question

I have written code which grabs a pin number from the URL, then it encrypts the pin number. I know want to put the encrypted “Key” back in the URL instead of the Original Pin. How can this be done?

I grab the Pin by:

string Pin = Request.QueryString["PIN"];

Is there an opposite of this to put it back in the URL?

Many thanks.

---

Thank you for your feedback.
Yes I am aware of this but it is ok as it is just for learning purposes. Sensitive information will not be used.

It is just a little program I am working on.

It now works, the only problem is that after using:

Response.Redirect("page.aspx?key=" + encryptedKey);

I cannot seem to display anything on the page; Updating a label for example.

Answer 1

You will have to redirect to a page with an ‘adjusted’ querystring;

var encryptedKey = EncryptPin(Request.QueryString["PIN"]);
Response.Redirect("page.aspx?key=" + encryptedKey);

However, information such as this should not really be sent around in a querystring, even if it is encrypted. Use Session, or even better, a proper Session Manager and store information within that.

I personally never store anything in querystring, but have to admit, it may have to happen in some scenarios.

Thinking a little more about this, I note that you are obviously sending the ‘Pin’ of your user within the current querystring to another page. Please think about the security considerations of this. To add to my point above about perhaps not using querystring for some information;

You should MOST DEFINATELY NOT use it for sensitive information such as this.

This will be stored in various places, easily accessible to anyone that cares to look and could lead to a compromise of the user’s account.