Question

I’m writing myself a script which basically lets me send a URL and two integer dimensions in the querystring of a single get request. I’m using base64 to encode it, but its pretty damn long and I’m concerned the URL may get too big.

Does anyone know an alternative, shorter method of doing this? It needs to be decode-able when received in a get request, so md5/sha1 are not possible.

Thanks for your time.

---

Edit: Sorry – I should have explained better: Ok, on our site we display screenshots of websites that get posted up for review. We have our own thumbnail/screenshot server. I’m basically going to be having the image tag contain an encoded string that stores the URL to take a screenshot of, and the width/height of the image to show. I dont however want it in ‘raw-text’ for the world to see. Obviously base64 can be decided by anyone, but we dont want your average joe picking up the URL path. Really I need to fetch: url, width, height in a single GET request.

Answer 1

It sounds like your goals are 1. to visually obscure a URL, and 2. to generally encode the data compactly for use in a URL.

First, we need to obscure the URL. Since URLs use much of the Base64 dictionary, any encoding that produces binary (that then has to be Base64-ed) will likely just increase the size. It’s best to keep the dictionary in the URL-safe range with minimal need for escaping when urlencode() is applied. I.e. you want this:

/**
 * Rot35 for URLs. To avoid increasing size during urlencode(), commonly encoded
 * chars are mapped to more rarely used chars (end of the uppercase alpha).
 *
 * @param string $url
 * @return string
 */
function rotUrl($url) {
    return strtr($url,
        'abcdefghijklmnopqrstuvwxyz0-:/?=&%#123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ',
        '123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0-:/?=&%#');
}

Now, for saving bytes, we can encode the URL schema into one char (say, h for HTTP, H for HTTPS), and convert the dimensions into base 32. Wrapping this up:

function obscure($width, $height, $url) {
    $dimensions = base_convert($width, 10, 32) . "."
                . base_convert($height, 10, 32) . ".";
    preg_match('@^(https?)://(.+)@', $url, $m);
    return $dimensions . (($m[1] === 'http') ? 'h' : 'H') . rotUrl($m[2]);
}

function unobscure($str) { /* exercise for the reader! */ }

$url = 'https://en.wikipedia.org/w/index.php?title=Special%3ASearch&search=Base64';
$obs = obscure(550, 300, $url);
// h6.9c.H5E.N9B9G5491.FI7UNU9E45O.G8GVK9KC5W-G5391CYcj-51I38XJ51I38Wk1J5fd

Since we avoided non URL-safe chars, if this is put in a querystring (with urlencode), it doesn’t grow much (in this case not at all).

Additionally you might want to sign this string so people who know the encoding still can’t specify their own parameters via the URL. For this you’d use HMAC, and Base64URL-encode the hash. You can also just keep a substring of the hash (~6 bits per character) to save space. sign() (below) adds an 8 character MAC (48 bits of the hash at 6 bits/char):

function sign($key, $data) {
    return $data . _hmac($key, $data, 8);
}
function verify($key, $signed) {
    $mac = substr($signed, -8);
    $data = substr($signed, 0, -8);
    return $mac === _hmac($key, $data, 8) ? $data : false;
}
function _hmac($key, $data, $macLength) {
    $mac = substr(base64_encode(hash_hmac('sha256', $data, $key, true)), 0, $macLength);
    return strtr($mac, '+/', '-_'); // for URL
}

$key = "Hello World!";
$signed = sign($key, $obs); // appends MAC: "w-jjw2Wm"

$obs = verify($key, $signed); // strips MAC and returns valid data, or FALSE

Update: a better RotURL function.