Skip to main content

How to write secure mvc application using encrypting URL

There are lots ways available to write the secure Mvc application. In my experience I came across lots of secure application in public facing. I want to tell about some of the mechanism I followed.
1- encrypting the URL Parameters and preserving id's encrypted on the client side
1- I always make sure if I pass Id or any sensitive data into the view always make sure it's encrypted. By doing so make sure if we forced to use HTML.hidden or HTML.hidden for have the encrypted values, in action link if I pass any parameters from the client side (eg:- edit or create or navigating between different actions we can make sure that all the values are encrypted)
During the design of the actions results if it's http get I usually encrypt the sensitive data
[httpget]
Public actionresult display()
{
TestModel testModel=new TestModel();
testModel.id= encrypt(id);
Return View(testModel);
}
[httppost]
Public ActionResult Display(string id)
{
Guid d_id= new Guid(decrypt(id));
// do operation with id
// edit, view, create
String e_id=encrypt(d_id);
Return RedirectToAction{"edit", e_id);
}
By following above encryption mechanism In view if you use the following code
<%:html.hiddenfor(model=>model.id);%>
Or  <%:html.hidden("id", Model.id);%>
Also we can make sure that the id won't be visible to the public.
Thanks
Adarsh

Comments

Popular posts from this blog

How to add a stored procedure in Entity Framework

Step1- Open the .edmx file
Step2- Right click in .edmx file and select Update Model from Database


Step3- Select Add tab, select Stored Procedures and select the procedure you want to add and click finish as shown in below figure a

Step4- Build the Entity Project to make sure nothing is broke

Step5- Right click on .edmx file and  select Model Browser



Step6- Model Browser Popup will appear as  below figure. Click on the Strored Procedures in PricingToolModel.Stroe and click the newly added SP (it will appear here)
Step7- The Add Function Import screen will appear

Based on the return we can set up.

If you are returning a multiple column Click on the Get Column Information First, then click the new Complex Type. After that you can see the Return of Collection will select the Complex and a complex type is generated by EF

If its returning scalar you can select which return type like int, string etc...

If its return entitty (means table) please select the correct table from the list..

Click…

Compiled Query- Improve the performance of Linq to Entity Query

Most of the small or medium IT firms are using the Entity framework for the Data Access layer (DAL). If we write a complex linq to Entity queries performance will always be an issue. But with the Compiled Query Performance can be improved. This below definitions are from MSDN and more details can be found on the MSDN Link that is at the end of this post 


         When you have an application that executes structurally similar queries many times in the Entity Framework, you can frequently increase performance by compiling the query one time and executing it several times with different parameters. For example, an application might have to retrieve all the QuoteRevision for a particular quotelineStatus, the quotelinestatus is specified at runtime. LINQ to Entities supports using compiled queries for this purpose.


              The compiled query class provides compilation and caching of queries for reuse. Conceptually, this class contains aCompiledQuery'sCompilemethod with several ove…