Re: Encrypted URL

[Thomas Chiverton <thomas.chiverton () bluefinger com>]

On Friday 30 Jan 2004 10:28 am, lupin wrote:
> http://example.com/796e62113e2936383e2b1796d626e676a6f6b6a6b6c67006a/appl?T
> Does anybody know more about this technique? Papers etc..? How to implement
> it? Google didn't help me a lot?

Easy enough to implement.
Have your web request handler do 
urlParams=decrypt(urlParams)
and make sure you call encrypt() on the string before appending it to any 
URL's in your application.

> What is you point of view? Do you think it will help to prevent all the
> parameter attack (XSS, SQL inj. etc...)?

It only encrypts what the user typed in anyway. If the XSS or SQL is in a form 
field, it won't really help there. However, if you're worried about people 
change ID numbers in URLs or something, it obviously helps a lot - dependant 
on how Evil they are, and how Good your encryption is.

-- 
Tom Chiverton 
Advanced ColdFusion Programmer

Tel: +44(0)1749 834997
email: tom.chiverton () bluefinger com
BlueFinger Limited
Underwood Business Park
Wookey Hole Road, WELLS. BA5 1AF
Tel: +44 (0)1749 834900
Fax: +44 (0)1749 834901
web: www.bluefinger.com
Company Reg No: 4209395 Registered Office: 2 Temple Back East, Temple
Quay, BRISTOL. BS1 6EG.
*** This E-mail contains confidential information for the addressee
only. If you are not the intended recipient, please notify us
immediately. You should not use, disclose, distribute or copy this
communication if received in error. No binding contract will result from
this e-mail until such time as a written document is signed on behalf of
the company. BlueFinger Limited cannot accept responsibility for the
completeness or accuracy of this message as it has been transmitted over
public networks.***