I’m working in C# ASP.Net and I want to hide GET values so that users cannot tinker with them. I need this because I’m creating a mechanism to allow for redirecting a POST back to a GET request, to enable browser back button navigation.
My first thought was to stash values in Session, but that seems against best practices for Session use.
What I’m trying to do now is to encrypt the query string and then use the encrypted string in the GET request. The problem is that the encrypted string is extremely long (1000+ charters), when the decrypted string is only about 30 characters.
The encryption logic I took from the MSDN here http://msdn.microsoft.com/en-us/library/system.security.cryptography.rsacryptoserviceprovider.aspx
Is there a way I can do this to get a shorter encrypted string?
Or, is there just a better way to do this in general?
You might try the technique at http://www.blackbeltcoder.com/Articles/security/encrypting-query-arguments.
It encrypts the query arguments and includes a checksum to make tampering difficult.