1

I have used MachineKey.Encode to encrypt a ID that is getting passed as a query string to a page but as expected this is making the URL huge.

Is there a option such as HTTP handlers that could customize the url but still load the required page?

Also I am yet to find out if MachineKey.Encode is using the MachineKey that I have defined in my web.config file to encrypt the data, can anybody confirm this for me with web information that backs this up.

Thanks.

RJF
  • 141
  • 1
  • 3
  • 12
  • Have a look at this http://stackoverflow.com/questions/2989703/how-can-you-secure-encrypt-your-querystring-in-asp-net – Bobby Feb 24 '12 at 11:07
  • not clear what is your problem here - not clear what you ask - what you try to solve. – Aristos Feb 24 '12 at 11:50
  • I was passing a encrypted value as a query string and was wondering if there was a method customizing the url to not show the query string. – RJF Feb 24 '12 at 12:18
  • Couldn't you just 'POST' the request instead? – SeanCocteau Feb 24 '12 at 13:47

1 Answers1

0

Also I am yet to find out if MachineKey.Encode is using the MachineKey that I have defined in my web.config file to encrypt the data, can anybody confirm this for me with web information that backs this up.

It does indeed use the configured keys. MachineKey calls MachineKeySection.EncryptOrDecryptData to perform the encryption, which uses encryption objects configured from the machine key section. If you want to see for yourself, the interesting calls are EncryptOrDecryptData=>EnsureConfig=>ConfigureEncryptionObject=>SetKeyOnSymAlgorithm

Andre Loker
  • 8,368
  • 1
  • 23
  • 36