Skip to main content

How to write secure mvc application using encrypting URL

There are lots ways available to write the secure Mvc application. In my experience I came across lots of secure application in public facing. I want to tell about some of the mechanism I followed.
1- encrypting the URL Parameters and preserving id's encrypted on the client side
1- I always make sure if I pass Id or any sensitive data into the view always make sure it's encrypted. By doing so make sure if we forced to use HTML.hidden or HTML.hidden for have the encrypted values, in action link if I pass any parameters from the client side (eg:- edit or create or navigating between different actions we can make sure that all the values are encrypted)
During the design of the actions results if it's http get I usually encrypt the sensitive data
[httpget]
Public actionresult display()
{
TestModel testModel=new TestModel();
testModel.id= encrypt(id);
Return View(testModel);
}
[httppost]
Public ActionResult Display(string id)
{
Guid d_id= new Guid(decrypt(id));
// do operation with id
// edit, view, create
String e_id=encrypt(d_id);
Return RedirectToAction{"edit", e_id);
}
By following above encryption mechanism In view if you use the following code
<%:html.hiddenfor(model=>model.id);%>
Or  <%:html.hidden("id", Model.id);%>
Also we can make sure that the id won't be visible to the public.
Thanks
Adarsh

Comments

  1. Harrah's Philadelphia Hotel & Casino | Casino, Gambling - AprCasino
    Harrah's Philadelphia Hotel & Casino 카지노사이트luckclub in Philadelphia offers guests the chance to experience it all 스포츠 토토 사이트 yourself while 실시간 바카라 사이트 위너바카라 taking advantage 카지노 사이트 큐어 벳 of our 메리트 카지노 사이트 amenities.

    ReplyDelete

Post a Comment

Popular posts from this blog

#saynotointerview for recruitment process

I recently went for a training that consists of employees from multinational corporations. During the brainstorming sessions, one fellow gentleman started speaking about firing his colleague. This guy is actually a senior manager and he interviewed the departed. He was blaming the unfortunate guy told he knows all the job description and he was smart during the interview. So they selected him for the job. But in the job, he never raised to his potential and they sacked him. The senior manager was claiming in the brainstorming session the decision was correct. But lots of people in training disagreed with that. Majority people told the recruitment or interview process in the company flawed to test that lad's knowledge. I strongly believe this might not be a one of the situation in recruitment? How many of you came across similar experience in your professional career? Do you believe the things we put in the job description are the exact things the potential employees will be do...

Bootstrap Server Side Sorting Cont....

On my previous post   I had already mentioned about how to apply the sort to Bootstrap paginated tables. By making the following changes server side sorting can be achieved along with pagination. On Filter Model self.sortBy = ko.observable( 'Id' );//Default sort Column self.sortAscending = ko.observable( false ); self.iconType = ko.observable( 'glyphicon glyphicon-chevron-down' ); // Icon to appear near Column No Changes to Adarsh Log Model or Adarsh Log list Model Knockout.js View Model for Adarsh Log Changes Add the sortTable  method to it self.sortTable = function (viewModel, e) {             var columClicked = $(e.target).attr( "data-column" )             var sortAscending = (self.filter().sortAscending() === true ) ? false : true ;             self.filter().sortAscendi...

Single page application (SPA) using ext.js

what is spa? Single page application are applications that fit in one page with rich and fluid user experiences like a desktop based applications. Why is SPA? All web based elements (html, CSS,javascript) are downloaded from the server on single page load and avoid the continuous page post back. i can explain what this mean. Suppose your web application is made of certain flow and it consists of 5 different pages. Each page need to get data from the user and save before moving to the next page. So when we navigate from one page to other it need to make a round trip to server to store the data in one page and get the data for the next page to display. but in spa we can avoid the continuous post backs. The whole page will not post back any time other than the first load. But it communicate to the server dynamically behind the scene and can achieve the same functionality. Spa using ext.js designing a SPA using ext.js is a challenging task if you are unaware about the ext.js ...