Passing encrypted IDs in query strings

Question

I am building a .Net app that effectively has news articles, some of which are available publicly and some of which are only available when you're logged in.

The URL to each article needs to include the article's ID in some way and until now I've been using AES to encrypt the article ID, using the user's ID as the 'shared secret' and an 8 digit string as salt.

e.g. /article.aspx?id=EvEAAAACtp2iEc7lKyJSu6382Ryl4k571L5/PQrJYY1JJfeq4F

The problem is that if the user views an article while logged in, they won't be able to copy the URL and send it on to anyone else as it won't work with another user's ID or with a non-logged-in user.

What's the right approach for including IDs in query strings (or anywhere else for that matter) when they need to be shared among known/unknown users?

Thanks.

Why does the article ID have to be encrypted at all? I assume you keep track whether a user is logged in through sessions or something similar. Just check whether the user is allowed to access the article on the server side and use the article's plain ID in the URL. — Felix Kling
– Felix Kling, Commented Aug 15, 2012 at 15:16
Is there a concrete reason for using an encrypted article ID instead of the plain article ID in combination with a standard access control mechanism (checking if a user is logged-in and has view permission)? — Robert
– Robert, Commented Aug 15, 2012 at 15:18

Rowland Shaw · Accepted Answer · 2012-08-15 15:17:16Z

1

Would it not be safer to pass the id on the query string in the clear, and have the web server check the client has sufficient credentials to read that article, and react appropriately? It could even return the relevant HTTP status code (401) to indicate that you need to log-in, or 403 to indicate that you cannot see it.

answered Aug 15, 2012 at 15:17

Rowland Shaw

38.2k15 gold badges104 silver badges168 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Fijjit Over a year ago

I guess this is just a general concern around exposing database IDs in the open - this would be pretty dangerous in the wrong hands, e.g. if the site was hacked. I assumed this would be best practice?

Rowland Shaw Over a year ago

This very site exposes an id for each question (and answer, and user).

Gabe · Accepted Answer · 2012-08-15 15:15:14Z

0

A common way to do this is to have a "Link" or "Share" button that generates a link that somebody can email.

answered Aug 15, 2012 at 15:15

Gabe

87.1k13 gold badges144 silver badges239 bronze badges

Collectives™ on Stack Overflow

Passing encrypted IDs in query strings

2 Answers 2

2 Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

2 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related