almost every time I use query strings to pass variables, I'll use the following class to put all of my information in a single tamper proof variable. This class is hacked up from some web tutorial i found some place, I tried to look for the reference but couldn't find it.
I wonder, why don't session variables work even in a web farm environment? will a couple of small session variables really make a huge difference? there are already a bunch of database calls with every page request, what's one more?
Another option you have would be storing the variables in the viewstate - so that the data exists on the return request itself and is tamper proofed by the viewstate validation that ASP.NET handles early in the page stack.
Systemsystem.Collections.SpecializedSystem.Security.Cryptography
Imports
System.Text
Imports
System.Web
Namespace
SecurityPublic Class SecureQueryString : Inherits NameValueCollectionPublic ReadOnly Property IsExpired() As Boolean
Get
Return _isExpiredEnd Get
End Property
Public Property ExpireTime() As DateTimeGet
Return _expireTimeEnd Get
_expireTime = value
Set(ByVal value As DateTime)End Set
End Property
Public ReadOnly Property EncryptedString() As String
Get
If IsExpired Then
Return ""
Else
Return HttpUtility.UrlEncode(encrypt(serialize))End If
End Get
End Property
Public Sub New()MyBase.New()End Sub
deserialize(decrypt(encryptedString))
_isExpired = DateTime.Compare(ExpireTime, DateTime.Now) < 0
Public Sub New(ByVal encryptedString)End Sub
Public Overrides Function ToString() As String
Return EncryptedStringEnd Function
Private Const cryptoKey As String = "changethis
Private timeStampKey As String = "__TimeStamp__"
Private ReadOnly IV As Byte() = {240, 3, 45, 12, 0, 16, 193, 59} 'change these numbers for securityPrivate _expireTime As DateTime = DateTime.MaxValuePrivate _isExpired As Boolean
Private Function encrypt(ByVal serializedQueryString) As String
des.Key = md5.ComputeHash(ASCIIEncoding.ASCII.GetBytes(cryptoKey))
des.IV = IV
Dim buffer As Byte() = Encoding.ASCII.GetBytes(serializedQueryString)Dim des As New TripleDESCryptoServiceProviderDim md5 As New MD5CryptoServiceProviderReturn Convert.ToBase64String(des.CreateEncryptor.TransformFinalBlock(buffer, 0, buffer.Length))End Function
Private Function decrypt(ByVal encryptedQueryString) As String
Try
des.Key = md5.ComputeHash(ASCIIEncoding.ASCII.GetBytes(cryptoKey))
des.IV = IV
Dim buffer As Byte() = Convert.FromBase64String(encryptedQueryString)Dim des As New TripleDESCryptoServiceProviderDim md5 As New MD5CryptoServiceProviderReturn Encoding.ASCII.GetString(des.CreateDecryptor.TransformFinalBlock(buffer, 0, buffer.Length))Catch ex As CryptographicExceptionThrow New Exception("InvalidQueryStringException", ex)Catch ex As FormatExceptionThrow New Exception("InvalidQueryStringException", ex)Catch ex As ExceptionThrow exEnd Try
End Function
Private Sub deserialize(ByVal decryptedQueryString As String)Dim nameValuePairs As String() = decryptedQueryString.Split("&")For i As Integer = 0 To nameValuePairs.Length - 1Dim nameValue As String() = nameValuePairs(i).Split("=")If nameValue.Length = 2 Then
MyBase.Add(nameValue(0), nameValue(1))End If
Next
If MyBase.Item(timeStampKey) IsNot Nothing Then
_expireTime = DateTime.Parse(
MyBase.Item(timeStampKey))End If
End Sub
Private Function serialize() As String
sb.Append(key &
Dim sb As New StringBuilderFor Each key As String In MyBase.AllKeys"=" & MyBase.Item(key) & "&")Next
'append timestamp
sb.Append(timeStampKey &
"=" & _expireTime)Return sb.ToStringEnd Function
End
End Class Namespace
Imports
Imports
Imports