Question

On our app we use secure function that make id in the road in other way:

We have for example: http://some.com/controller/action/12

In secure it will be: http://some.com/controller/action/bs16gz

We need to impelement auto securing (read: do not secure and unsecure Id in each controller). So it should be general solution what will be automatically implemented in all application.

Any ideas?

—-Why we need it?—–

We want to prevent user to change id in QueryString for looking into another item

Exmaple:http://some.com/controller/action/12 is one record, then user change id to 13 and see another record. It’s needs to our system to prevent this actions.

Answer 1

I wonder why would you need that. If you don’t want someone “in the middle” to see these IDs, secure your HTTP traffic with SSL. If you don’t want users to access other users’ content, put security in place.

But if you’re still after securing IDs, I think model binders is the way to go:

class MyController 
{
    ActionResult Index(SecureID id) 
    {
        var resource = ResourceRepository.Get<Resource>(id); // implicit conversion to long