Home/ Questions/Q 8998351
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-16T00:00:52+00:00

I programed an application with asp.net and use respons.redirect in some pages, like this:

  • 0

I programed an application with asp.net and use “respons.redirect” in some pages, like this:

Response.Redirect(string.Format("~/*****/****.aspx?ID={0}", ID));

as user execute this cod he will redirect to correct page and every thing is fine .he can see this redirect link in his browser address :

http://localhost:1852/Jornal/Editor/ReviewerEmail.aspx?ID=1030

Now if he changes the ID manually and the ID is correct he can access the other data without any permission. how can i avoid this problem?(I wont use session)
please help me

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    If the ID needs to be public and no access control can solve the problem.

    then i would suggest that you add a second parameter that is a hash of that Id.
    Tampering with the ID parameter will cause a missmatch between ID and hash

    http://msdn.microsoft.com/en-us/library/system.security.cryptography.sha256.aspx

    you cold also change your ID parameter to a less ‘guessable’ id, like a GUID

    • 0