Home/ Questions/Q 550589
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-13T11:18:15+00:00

I need to create a token to appear on a querystring that can be

  • 0

I need to create a token to appear on a querystring that can be passed to a web page and decoded in order to find a record in a database view.

The token should not be vulnerable to brute force incrementing value type attacks.

View records in the database are uniquely defined as a combination of two keys.

The generation of this token needs to happen in the database and on demand. The database is accessed directly by another system that generates emails utilising the data in the view.

I have tried generating a sha1 hash based on the two keys and then url safe base64 encoding the result, but since it is a one way operation the lookup at the web end is unacceptably slow.

I think symmetric key encryption would be suitable, as long as the encryption occurred in the database, and the decryption occurred in the website, before the lookup.

At this stage I’m leaning towards building a CLR function to populate a generated column in the view.

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    I’ve ended up writing a CLR function that uses triple DES to encrypt a salted concatenated string containing the keys I need. This function is used for a computed column on the view.

    I used this page as a basis for the triple DES code:
    http://www.dotnetspark.com/kb/1279-triple-des-encryption-and-decryption-using.aspx

    It’s performant and secure, though a bit more work than I think is necessary in most situations.

    • 0