Encrypt Url Parameter In asp.net Mvc

Question

@using(Html.BeginForm("Action", "Controller", FormMethod.Get)
{          
  @Html.TextBoxFor(model=>model.Id)
  <input type="submit" value="Search" />
}

1-When we click On Submit Button this will Create Url Like this

    http://localhost:53734/Controller/Action?id=10  
    //10 is input From Textbox

I want to encrypt Id parameter like http://localhost:53734/Controller/Action?id=encrypted Value Of 10

Use HTTPS instead. If you encrypt anything in *Javascript* it will be obvious to whoever has access to the page source. That includes the hackers that may hack any intermediate proxy, router. — Panagiotis Kanavos, Mar 26 '19 at 14:31
What are you trying to protect against? Prevent someone between client and server from stealing the parameters? Or prevent the server-side code from reading the parameter? Encryption could protect only against the second case — Panagiotis Kanavos, Mar 26 '19 at 14:46
Only want to protect Url server Side user Can't see the actual value of id Paramete — Pradeep Vaishya, Mar 26 '19 at 14:58

Piotr Stapp · Accepted Answer · 2019-03-26T14:43:04.287

0

As I understand you want to "hide" and "protect" the request. The best solution is to:

Use HTTPS so the transport will provide encryption
All parameters in GET and POST are encrypted (more Are HTTPS URLs encrypted?).

If it is not possible, use RSACryptProvider to encrypt parameter. The universal encryption code is in MSDN: https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.rsacryptoserviceprovider?view=netframework-4.7.2

edited Mar 26 '19 at 14:43

answered Mar 26 '19 at 14:35

Piotr Stapp

19,392
11
68
116

1

[URLs are also encrypted](https://stackoverflow.com/questions/499591/are-https-urls-encrypted). The *entire* payload is encrypted, not just parts of it. – Panagiotis Kanavos Mar 26 '19 at 14:36
As for using AES (ie RSA) the Javascript code would have to encrypt the parameter using a common password. Both the encryption code and the password would be exposed to any MITM attack. – Panagiotis Kanavos Mar 26 '19 at 14:39
@PanagiotisKanavos you are right, I will update an answer – Piotr Stapp Mar 26 '19 at 14:41
@PanagiotisKanavos but his code is not JavaScript it is classic ASP.NET MVC – Piotr Stapp Mar 26 '19 at 14:42
Who's going to *encrypt* the form's fields? – Panagiotis Kanavos Mar 26 '19 at 14:43
@PanagiotisKanavos nothing, but in most cases, it is just redundant. Usually, it looks like security by obscurity. – Piotr Stapp Mar 26 '19 at 14:45

Encrypt Url Parameter In asp.net Mvc

1 Answers1