2009-03-02 13 views

risposta

12

Consultare l'articolo Mads Kristensen's per un HttpModule che crittografa/decrittografa tutte le tue querystrings.

Il suo codice utilizza un HttpModule per analizzare l'HTML in uscita per crittografare e sostituire tutte le querystring relative del percorso. HttpModule cattura anche le richieste in arrivo e riscrive l'url della richiesta per utilizzare una querystring non criptata.

La parte interessante è che è possibile rilasciare il modulo e il codice non ha bisogno di sapere quando le querystring sono crittografate o meno. Dal punto di vista del codice, i querystrings funzionano come fanno sempre.

Lo stiamo usando da oltre cinque anni e funziona benissimo.

+1

-1: URL interrotto! –

+11

@AlexAngas Invece di fare downvoting, sembra che tu abbia potuto usare quel tempo per cercare dove l'url è stato spostato e modificato il mio post per riflettere quello. L'ho pubblicato quasi 5 anni fa. Ma ho aggiornato l'URL. – slolife

+2

Oppure salva il tuo tempo e quello della comunità scrivendo una risposta che resterà attiva. http://meta.stackexchange.com/a/7658/6651. Spiacente, nessuna offesa intesa. –

1

Creare una stringa di coppia chiave/valore. Criptalo. Base64 esso. Ora, basta avere una variabile stringa di query denominata "x" o qualcosa del genere, e il valore sarà la stringa Base64, così simile:

domain.com/MyPage?x=hfjhwke878979blahblah

Quindi, è decifrare e l'uso e riporlo in una struttura dati chiave/valore. Questo è un approccio.

+0

si può dare qualche esempio – Sarathy

+0

per convertire una stringa in base64: Convert.ToBase64String (Text.Encoding.ASCII.GetBytes (stringToConvert)) per convertire in una stringa: Text.Encoding.ASCII.GetString (Convertire. FromBase64String (stringToConvertBack)) – hacker

+0

base64 contiene caratteri che non sono consentiti negli URL! –

0

È possibile crittografare la stringa con gli strumenti di crittografia .NET incorporati. È necessario utilizzare Server.HtmlEncode/Server.HtmlDecode sulla stringa per garantire che la stringa crittografata sia conforme a HTTP.

Here è un articolo sulla crittografia in .NET.

2

file di codice Stupidamente lungo che lo farà per voi con piena encyption:

io suggerisco di usare il SessionID come il sale, quindi cambia per ogni utente, ma è stabile in tutta postback.

/////////////////////////////////////////////////////////////////////////////// 
// SAMPLE: Symmetric key encryption and decryption using Rijndael algorithm. 
// 
// To run this sample, create a new Visual C# project using the Console 
// Application template and replace the contents of the Class1.cs file with 
// the code below. 
// 
// THIS CODE AND INFORMATION IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND, 
// EITHER EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE IMPLIED 
// WARRANTIES OF MERCHANTABILITY AND/OR FITNESS FOR A PARTICULAR PURPOSE. 
// 
// Copyright (C) 2002 Obviex(TM). All rights reserved. 
// 
using System; 
using System.IO; 
using System.Text; 
using System.Security.Cryptography; 
namespace TDX.Portal.Utilities 
{ 
    /// <summary> 
    /// This class uses a symmetric key algorithm (Rijndael/AES) to encrypt and 
    /// decrypt data. As long as encryption and decryption routines use the same 
    /// parameters to generate the keys, the keys are guaranteed to be the same. 
    /// The class uses static functions with duplicate code to make it easier to 
    /// demonstrate encryption and decryption logic. In a real-life application, 
    /// this may not be the most efficient way of handling encryption, so - as 
    /// soon as you feel comfortable with it - you may want to redesign this class. 
    /// </summary> 
    public class RijndaelSimple 
    { 
     /// <summary> 
     /// Encrypts specified plaintext using Rijndael symmetric key algorithm 
     /// and returns a base64-encoded result. 
     /// </summary> 
     /// <param name="plainText"> 
     /// Plaintext value to be encrypted. 
     /// </param> 
     /// <param name="passPhrase"> 
     /// Passphrase from which a pseudo-random password will be derived. The 
     /// derived password will be used to generate the encryption key. 
     /// Passphrase can be any string. In this example we assume that this 
     /// passphrase is an ASCII string. 
     /// </param> 
     /// <param name="saltValue"> 
     /// Salt value used along with passphrase to generate password. Salt can 
     /// be any string. In this example we assume that salt is an ASCII string. 
     /// </param> 
     /// <param name="hashAlgorithm"> 
     /// Hash algorithm used to generate password. Allowed values are: "MD5" and 
     /// "SHA1". SHA1 hashes are a bit slower, but more secure than MD5 hashes. 
     /// </param> 
     /// <param name="passwordIterations"> 
     /// Number of iterations used to generate password. One or two iterations 
     /// should be enough. 
     /// </param> 
     /// <param name="initVector"> 
     /// Initialization vector (or IV). This value is required to encrypt the 
     /// first block of plaintext data. For RijndaelManaged class IV must be 
     /// exactly 16 ASCII characters long. 
     /// </param> 
     /// <param name="keySize"> 
     /// Size of encryption key in bits. Allowed values are: 128, 192, and 256. 
     /// Longer keys are more secure than shorter keys. 
     /// </param> 
     /// <returns> 
     /// Encrypted value formatted as a base64-encoded string. 
     /// </returns> 
     public static string Encrypt(string plainText, 
            string passPhrase, 
            string saltValue, 
            string hashAlgorithm, 
            int passwordIterations, 
            string initVector, 
            int keySize) 
     { 
      // Convert strings into byte arrays. 
      // Let us assume that strings only contain ASCII codes. 
      // If strings include Unicode characters, use Unicode, UTF7, or UTF8 
      // encoding. 
      byte[] initVectorBytes = Encoding.UTF8.GetBytes(initVector); 
      byte[] saltValueBytes = Encoding.UTF8.GetBytes(saltValue); 

      // Convert our plaintext into a byte array. 
      // Let us assume that plaintext contains UTF8-encoded characters. 
      byte[] plainTextBytes = Encoding.UTF8.GetBytes(plainText); 

      // First, we must create a password, from which the key will be derived. 
      // This password will be generated from the specified passphrase and 
      // salt value. The password will be created using the specified hash 
      // algorithm. Password creation can be done in several iterations. 
      PasswordDeriveBytes password = new PasswordDeriveBytes(
                  passPhrase, 
                  saltValueBytes, 
                  hashAlgorithm, 
                  passwordIterations); 

      // Use the password to generate pseudo-random bytes for the encryption 
      // key. Specify the size of the key in bytes (instead of bits). 
      byte[] keyBytes = password.GetBytes(keySize/8); 

      // Create uninitialized Rijndael encryption object. 
      RijndaelManaged symmetricKey = new RijndaelManaged(); 

      // It is reasonable to set encryption mode to Cipher Block Chaining 
      // (CBC). Use default options for other symmetric key parameters. 
      symmetricKey.Mode = CipherMode.CBC; 

      // Generate encryptor from the existing key bytes and initialization 
      // vector. Key size will be defined based on the number of the key 
      // bytes. 
      ICryptoTransform encryptor = symmetricKey.CreateEncryptor(
                  keyBytes, 
                  initVectorBytes); 

      // Define memory stream which will be used to hold encrypted data. 
      MemoryStream memoryStream = new MemoryStream(); 

      // Define cryptographic stream (always use Write mode for encryption). 
      CryptoStream cryptoStream = new CryptoStream(memoryStream, 
                 encryptor, 
                 CryptoStreamMode.Write); 
      // Start encrypting. 
      cryptoStream.Write(plainTextBytes, 0, plainTextBytes.Length); 

      // Finish encrypting. 
      cryptoStream.FlushFinalBlock(); 

      // Convert our encrypted data from a memory stream into a byte array. 
      byte[] cipherTextBytes = memoryStream.ToArray(); 

      // Close both streams. 
      memoryStream.Close(); 
      cryptoStream.Close(); 

      // Convert encrypted data into a base64-encoded string. 
      string cipherText = Convert.ToBase64String(cipherTextBytes); 

      // Return encrypted string. 
      return cipherText; 
     } 

     /// <summary> 
     /// Decrypts specified ciphertext using Rijndael symmetric key algorithm. 
     /// </summary> 
     /// <param name="cipherText"> 
     /// Base64-formatted ciphertext value. 
     /// </param> 
     /// <param name="passPhrase"> 
     /// Passphrase from which a pseudo-random password will be derived. The 
     /// derived password will be used to generate the encryption key. 
     /// Passphrase can be any string. In this example we assume that this 
     /// passphrase is an ASCII string. 
     /// </param> 
     /// <param name="saltValue"> 
     /// Salt value used along with passphrase to generate password. Salt can 
     /// be any string. In this example we assume that salt is an ASCII string. 
     /// </param> 
     /// <param name="hashAlgorithm"> 
     /// Hash algorithm used to generate password. Allowed values are: "MD5" and 
     /// "SHA1". SHA1 hashes are a bit slower, but more secure than MD5 hashes. 
     /// </param> 
     /// <param name="passwordIterations"> 
     /// Number of iterations used to generate password. One or two iterations 
     /// should be enough. 
     /// </param> 
     /// <param name="initVector"> 
     /// Initialization vector (or IV). This value is required to encrypt the 
     /// first block of plaintext data. For RijndaelManaged class IV must be 
     /// exactly 16 ASCII characters long. 
     /// </param> 
     /// <param name="keySize"> 
     /// Size of encryption key in bits. Allowed values are: 128, 192, and 256. 
     /// Longer keys are more secure than shorter keys. 
     /// </param> 
     /// <returns> 
     /// Decrypted string value. 
     /// </returns> 
     /// <remarks> 
     /// Most of the logic in this function is similar to the Encrypt 
     /// logic. In order for decryption to work, all parameters of this function 
     /// - except cipherText value - must match the corresponding parameters of 
     /// the Encrypt function which was called to generate the 
     /// ciphertext. 
     /// </remarks> 
     public static string Decrypt(string cipherText, 
            string passPhrase, 
            string saltValue, 
            string hashAlgorithm, 
            int passwordIterations, 
            string initVector, 
            int keySize) 
     { 
      // Convert strings defining encryption key characteristics into byte 
      // arrays. Let us assume that strings only contain ASCII codes. 
      // If strings include Unicode characters, use Unicode, UTF7, or UTF8 
      // encoding. 
      byte[] initVectorBytes = Encoding.UTF8.GetBytes(initVector); 
      byte[] saltValueBytes = Encoding.UTF8.GetBytes(saltValue); 

      // Convert our ciphertext into a byte array. 
      byte[] cipherTextBytes = Convert.FromBase64String(cipherText); 

      // First, we must create a password, from which the key will be 
      // derived. This password will be generated from the specified 
      // passphrase and salt value. The password will be created using 
      // the specified hash algorithm. Password creation can be done in 
      // several iterations. 
      PasswordDeriveBytes password = new PasswordDeriveBytes(
                  passPhrase, 
                  saltValueBytes, 
                  hashAlgorithm, 
                  passwordIterations); 

      // Use the password to generate pseudo-random bytes for the encryption 
      // key. Specify the size of the key in bytes (instead of bits). 
      byte[] keyBytes = password.GetBytes(keySize/8); 

      // Create uninitialized Rijndael encryption object. 
      RijndaelManaged symmetricKey = new RijndaelManaged(); 

      // It is reasonable to set encryption mode to Cipher Block Chaining 
      // (CBC). Use default options for other symmetric key parameters. 
      symmetricKey.Mode = CipherMode.CBC; 

      // Generate decryptor from the existing key bytes and initialization 
      // vector. Key size will be defined based on the number of the key 
      // bytes. 
      ICryptoTransform decryptor = symmetricKey.CreateDecryptor(
                  keyBytes, 
                  initVectorBytes); 

      // Define memory stream which will be used to hold encrypted data. 
      MemoryStream memoryStream = new MemoryStream(cipherTextBytes); 

      // Define cryptographic stream (always use Read mode for encryption). 
      CryptoStream cryptoStream = new CryptoStream(memoryStream, 
                  decryptor, 
                  CryptoStreamMode.Read); 

      // Since at this point we don't know what the size of decrypted data 
      // will be, allocate the buffer long enough to hold ciphertext; 
      // plaintext is never longer than ciphertext. 
      byte[] plainTextBytes = new byte[cipherTextBytes.Length]; 

      // Start decrypting. 
      int decryptedByteCount = cryptoStream.Read(plainTextBytes, 
                 0, 
                 plainTextBytes.Length); 

      // Close both streams. 
      memoryStream.Close(); 
      cryptoStream.Close(); 

      // Convert decrypted data into a string. 
      // Let us assume that the original plaintext string was UTF8-encoded. 
      string plainText = Encoding.UTF8.GetString(plainTextBytes, 
                 0, 
                 decryptedByteCount); 

      // Return decrypted string. 
      return plainText; 
     } 
    } 
} 
0

Si supponga di avere un'url del tipo:

www.example.com/customerAdd.aspx?customerId=custId&password=weak 

Che cosa si può fare è quello di prendere la stringa "customerId = CustID & password = deboli", cifrare con una chiave, codificare il testo cifrato risultante a base64 e ora l'URL diventa (qualcosa di simile):

www.example.com/customerAdd.aspx?s=KJADSN1234kNmnanjnads 

ricordarsi di memorizzare la chiave di crittografia nella SE lato rver. Non inviarlo al lato client.

Ora, se si utilizza la stessa chiave per tutte le sessioni di crittografia, è possibile riutilizzare l'URL. Ad esempio, puoi inviare l'URL a qualcun altro e possono visitare la stessa pagina. Ma questo schema riduce la sicurezza della tua crittografia.

Se si modifica la chiave di crittografia per ogni sessione, si ottiene una maggiore sicurezza ma l'URL non sarà valido dopo la chiusura della sessione.

0

Provare a creare un blocco di script come the one on this page.

Consente di aggiungere una semplice classe e crittografare/decrittografare una stringa utilizzando una semplice password. È possibile utilizzare Session.SessionID come password. Fai attenzione che i collegamenti non funzionano più una volta che l'utente chiude la sua finestra del browser.

Nota: TripleDES non è molto sicuro, vedere this Microsoft articolo

+0

Quando si parla di sicurezza, Microsoft dovrebbe rimanere in silenzio. – Nayef

Problemi correlati