URL Scrambling for Dynamic Data

Question

What is the best way to obfuscate URLs generated in dynamic data?

eg \ Products \ List.aspx? ProductId = 2 may become

\ Products \ List.aspx? x = UHJvZHVjdElkPTI =

where "ProductId = 2" is base 64 encoded to prevent accidental tracking on

\ Products \ List.aspx? ProductID = 3

\ Products \ List.aspx? ProductID = 4

etc...?

I probably have to inherit from an existing object and override some function. The question is which object and which function

The GetActionPath of the Metamodel object seems interesting, but how DynamicRoute "{table} / {Action} .aspx" works ...

Now on Asp.net 1.1, I am using a custom implementation of the following code. http://www.mvps.org/emorcillo/en/code/aspnet/qse.shtml The HTTPModule uses a regular expression to overwrite all repeats, and also changes the Querystring collection with decoded values ​​with reflection.

So where does the hook affect the change.

Answer 1

I found a solution

With advice, I implemented a Route that inherits from DynamicDataRoute.

The deferred methods were GetVirtualPath and GetRouteData.

Here is the global.asax page

routes.Add(New EncodedDynamicDataRoute("{table}/{action}.aspx") With { _ .Defaults = New RouteValueDictionary(New With {.Action = PageAction.List}), _ .Constraints = New RouteValueDictionary(New With {.Action "List|Details|Edit|Insert"}), _ .Model = model}) 

Here is the encoded DynamicDataRoute.

 Imports System.Web.DynamicData Imports System.Web.Routing ''' <summary> ''' The purpose of this class to base 64 encode the querystring parameters. ''' It converts the keys to base64 encoded and back. ''' </summary> Public Class EncodedDynamicDataRoute Inherits DynamicDataRoute Public Sub New(ByVal url As String) MyBase.New(url) End Sub Public Overloads Overrides Function GetRouteData(ByVal httpContext As HttpContextBase) As RouteData Dim routeData As RouteData = MyBase.GetRouteData(httpContext) If Not (routeData Is Nothing) Then DecodeRouteValues(routeData.Values) End If Return routeData End Function Private Sub EncodeRouteValues(ByVal routeValues As RouteValueDictionary) Dim tableName As Object If Not routeValues.TryGetValue("table", tableName) Then Return End If Dim table As MetaTable If Not Model.TryGetTable(DirectCast(tableName, String), table) Then Return End If Dim strOutput As New StringBuilder Dim val As Object For Each column As MetaColumn In table.PrimaryKeyColumns If routeValues.TryGetValue(column.Name, val) Then strOutput.Append(column.Name & Chr(254) & val & Chr(255)) routeValues.Remove(column.Name) End If Next Dim out As String = (Convert.ToBase64String(Encoding.ASCII.GetBytes(strOutput.ToString))) If routeValues.ContainsKey("x") Then routeValues.Item("x") = out Else routeValues.Add("x", out) End If End Sub Public Overloads Overrides Function GetVirtualPath(ByVal requestContext As RequestContext, ByVal values As RouteValueDictionary) As VirtualPathData EncodeRouteValues(values) Return MyBase.GetVirtualPath(requestContext, values) End Function Private Sub DecodeRouteValues(ByVal routeValues As RouteValueDictionary) Dim tableName As Object If Not routeValues.TryGetValue("table", tableName) Then Return End If Dim table As MetaTable If Not Model.TryGetTable(DirectCast(tableName, String), table) Then Return End If Dim enc As New System.Text.ASCIIEncoding() Dim val As Object If routeValues.TryGetValue("x", val) AndAlso val <> "AAA" Then Dim strString As String = enc.GetString(Convert.FromBase64String((val))) Dim nameValuePairs As String() = strString.Split(Chr(255)) Dim col As MetaColumn For Each str11 In nameValuePairs Dim vals() As String = str11.Split(Chr(254)) If table.TryGetColumn(vals(0), col) Then routeValues.Add(val(0), col) End If Next End If End Sub End Class 

Answer 2

Here is how I did it:

I created 4 modules in a module:

 public static string EncryptInt(int val) public static int DecryptInt(string val) public static string DecryptStr(string str) public static string EncryptStr(string source) 

When I wanted to create a URL, I did something like this:

  string.Format(@"\path\file.aspx?ID={0}&name={1}",encrypt.EncryptInt(inID),encrypt.EncriptStr(inName)); 

When I wanted to get the results, I would call the Decrypt function on the received parameter.

I used two types because he added a type level security to the system, but you could just use it with strings and then call int.Parse () as needed.

Does this answer your question?

For Microsoft Dynamic Data, I believe that the hooks will be found in the code for the template pages.