In ASP.NET MVC, how can I GET sensitive data while maintaining a "user friendly" URL?

Question

I'm building an online music store and I'm having trouble displaying the info page for a single album.

I want the url to look something like this: www.musicshop.com/albums/artist_name/album_name

How can I map this kind of url to a Controller and how can I pass the id of the album (without showing it in the url)?

This isn't related to MVC, it's just HTTP. You don't GET *to* a page, you get *FROM* a page. You are treating HTTP GET as if it were POST. You can't add parameters in a GET that won't show in the URL. What would happen if a user typed the URL or added a bookmark to it? You'll have to search using the artist and album names in your controller — Panagiotis Kanavos, Mar 31 '16 at 08:12
My question was oddly formulated. I (mostly) know how GET works. Thanks for answering! Also, do you think adding the ID at the end of the URL (right after the album and artist names) is a bad idea? — Jason Node, Mar 31 '16 at 08:25
Possible duplicate of [Multiple levels in MVC custom routing](http://stackoverflow.com/questions/31934144/multiple-levels-in-mvc-custom-routing) — NightOwl888, Mar 31 '16 at 09:20

score 0 · Accepted Answer · answered Mar 31 '16 at 08:14

0

You either need to use artist_name and album_name in order to find the album or you need to pass the id.

If you are using artist_name and album_name approach your controller action should look like this

public ActionResult Album(string artist_name, string album_name) 
{
    //get album by artist name and album name
}

The route for this will be

routes.MapRoute(name: "AlbumByArtistNameAndAlbumName",
                url: "albums/{artist_name}/{album_name}",
                defaults: new { controller = "Albums", action = "Album" });

answered Mar 31 '16 at 08:14

Alex Art.

8,711
3
29
47

Thank you! Do you think adding the ID at the end of the URL (right after the album and artist names) is a bad idea? – Jason Node Mar 31 '16 at 08:26
It could be problematic because artist_name and album_name parameters are irrelevant, and it could introduce some undesired behavior for example: `albums/U2/The_Best/1` and `albums/Beatles/Abbey_Road/1` from user perspective the are different urls right (different artists and different albums ) but there is the same id which is going to be use to retrieve the album (that could point to something totally different). If you handle all such cases with 404 then I guess it should be fine to add the id at the end – Alex Art. Mar 31 '16 at 08:33
@AlexArt. huh? Why would two completely different albums have the same ID ? If the end user typed the wrong articst/album/ID combination the proper answer would be a 404. – Panagiotis Kanavos Mar 31 '16 at 08:38
@AlexArt. thanks, I get it. Seems like the `artist_name` + `album_name` approach would work best, no need for ID. – Jason Node Mar 31 '16 at 08:45
@PanagiotisKanavos. Please read my answer carefully. I did emphasize the handling of the wrong combination scenario. Regarding the user input and SEO you never know what url params are going to be supplied. So if for example google bot will try wrong name/id combination and it will return 200, this (wrong) url will be added to a search index – Alex Art. Mar 31 '16 at 08:50
@JasonNode. I would go with `artist_name + album_name` as well. Don't forget add indexes in the DB. and measure the performance – Alex Art. Mar 31 '16 at 08:51

score 0 · Answer 2 · answered Mar 31 '16 at 08:14

If you want to keep the URL in the current format you need a post request. Why is it bad to see the album id in the URL? You could alternatively use some different way to query the DB for the album like 'artist_name' + 'album_name' and create an index on them(for having the query faster) or you can use even a composite key from the 2 fields and remove the id completely if you think it makes sense, although I don't think it's a very good idea.

score 0 · Answer 3 · answered Mar 31 '16 at 08:14

You can't. One benefit of using GET is that these URLs are suitable for inclusion in search engines. A GET URL should contain everything needed to render the page, or else anyone coming from e.g. Google to you will have a bad experience.

Either derive the id from artist_name + album_name, or make the URL look like www.musicshop.com/albums/id/artist_name/album_name.

In ASP.NET MVC, how can I GET sensitive data while maintaining a "user friendly" URL?

3 Answers3