ASP.Net MVC: Should I hash or encrypt route and query string data?

Question

My programming knowledge is not very good. So here I discussed query string and route data security. Please review my approach and tell me am I thinking right way.

Often we work with query string and route data pass to controller action. So user can edit those data. For security purpose I do not allow to user edit route and query string data.

So I thought i will create a hash using those query string and route data and append that hash to end of URL.

1. Is my thinking correct?
2. Should I hash or encrypt query string and route data?
3. Which one will be best...hashing or encrypt query string and route data?

This is the way I am doing it now. Here is bit code snippet:

@Html.ActionLink("Test", "Index", new { page = 1, q = Utility.HashData("Hello") })

public static class Utility
{
    public static string HashData(string input)
    {
        string retdata="";
        string salykey = "!xcorb@sinon_";
        byte[] inputBytes = Encoding.UTF8.GetBytes(string.Concat(input, salykey));
        SHA512Managed sha512 = new SHA512Managed();

        byte[] outputBytes = sha512.ComputeHash(inputBytes);
        string b64 = Convert.ToBase64String(outputBytes);
        b64 = b64.Replace('+', '-');
        retdata = b64.Replace('/', '_');
        return retdata;
    }
}

I am hashing data hello and now URL look like http://localhost:61151/Home/Index/1?q=NhX4DJ0pPtdAJof5SyLVjlKbjMeRb4-sf933-9WvTPd309eVp6AKFr9-fz-5Vh7puq5IDan-ehh2nnGIawPzFQ%3D%3D

Is it ok?

I just hash Hello and now see how big hash has been generated. So when I will hash many query string and route data together then my hash data will be huge. So if it will be huge that may cause an issue because the URL length must has some limitation....am I right?

4. Can I shorten hashing data length? If possible then which hashing algorithm I should use?

Please discuss my points and drive me to right direction. Thanks.

Answer 1

Should I hash or encrypt route and query string data?

Hashing

As pointed out by others, hashing implies that the data is irreversibly encoded so this is not an option.

Route Data

Route data is read by MVC and used to make MVC function correctly. Unless it is passed to the route via the URL path, route data is not even accessible outside of the web server. So, the answer is no don't encrypt route values.

Query Strings

Query strings on the other hand are exposed to users. So if you have any data you want to be kept from view, it is recommended to pass it via form POST values rather than through a URL. Never pass data you want to be private through the query string (encrypted or not).

From How Secure Are Query Strings Over HTTPS?:

You can rely on an HTTPS request being secure so long as:

• No SSL certificate warnings were ignored
• The private key used by the web server to initiate the SSL connection is not available outside of the web server itself.

So at the network level, URL parameters are secure, but there are some other ways in which URL based data can leak:

1. URLs are stored in web server logs
2. URLs are stored in the browser history
3. URLs are passed in Referrer headers

So a malicious user could potentially copy a URL from one of these locations.

In summary:

1. The best option is to never let private data leave the server. Keep it in a database, cache, session state, or TempData (which uses session state by default). Less sensitive data may be encrypted and stored in cookies on the client.
2. If you need to pass sensitive data from the user to your application, do it through form values via HTTP POST and always use SSL encryption on these requests.
3. URLs are designed to be public and will almost certainly be kept around in logs. Assume that everyone can access them. Never pass any sensitive data (encrypted or not) through the URL.