Search - Articles
DevASP.NET for ASP.NET, VB.NET, XML and C# (C-Sharp) Developers Tuesday, March 03, 2009
Dev Articles
Search Directory
ASP.NET
VB.Net
C-Sharp
SQL Server
 

How to Encrypt and Decrypt Query String in ASP.NET

Author: Richard Wand
Download Source Code : 1354_EncryptDecryptQueryString.zip

This article will explain how we can encrypt and decrypt query string in ASP.NET.

 

Query string is a common and popular way to pass values between pages but it is not a safer way because all the values are visible to users in normal text format. Users can change and play with these values so there is security issue involved with query string way of passing values to between pages.  You can use other techniques to pass values between pages but there may be some situations when you need to pass some values using query string and you don’t want to show these values to users.  Encrypt query string is the way to handle this situation. You can encrypt your query string values and pass these values in URL. Later you can decrypt these values to see in normal text.

  1. Create new website in Visual Studio 2010
  2. Add a Default.aspx web form in the website
  3. Add another web form and rename the page as Page2.aspx
  4. Add a button in Default.aspx page

    <asp:Button ID="btnEncrypt" runat="server"
           Text="Go to Page 2 with encrypted query string " onclick="btnEncrypt_Click" />
     
  5. Add a button and a label in Page2.aspx

    <asp:Button ID="btnDerypt" runat="server"
          Text="Click to see decrypted query string" onclick="btnDecrypt_Click" />
    <br />
    <asp:Label ID="lblURL" runat="server" ></asp:Label>
     
  6. We have to use following namespaces in our code

    C#
     
    using System.IO;
    using System.Text;
    using System.Security.Cryptography;
     
    VB.NET

    Imports System.IO
    Imports System.Text
    Imports System.Security.Cryptography
     
  7. Add a function in code file of Default.aspx for encryption

    C#

    public string EncryptString(string inputString)
    {
        MemoryStream memStream = null;
        try
        {
            byte[] key = { };
            byte[] IV = { 12, 21, 43, 17, 57, 35, 67, 27 };
            string encryptKey = "aXb2uy4z";
            key = Encoding.UTF8.GetBytes(encryptKey);
            byte[] byteInput = Encoding.UTF8.GetBytes(inputString);
            DESCryptoServiceProvider provider = new DESCryptoServiceProvider();
            memStream = new MemoryStream();
            ICryptoTransform transform = provider.CreateEncryptor(key, IV);
            CryptoStream cryptoStream = new CryptoStream(memStream, transform, CryptoStreamMode.Write);
            cryptoStream.Write(byteInput, 0, byteInput.Length);
            cryptoStream.FlushFinalBlock();
              
        }
        catch (Exception ex)
        {
            Response.Write(ex.Message);
        }
        return Convert.ToBase64String(memStream.ToArray());
    }
     
    VB.NET

    Public Function EncryptString(ByVal inputString As String) As String
        Dim memStream As MemoryStream = Nothing
        Try
            Dim key As Byte() = {}
            Dim IV As Byte() = {12, 21, 43, 17, 57, 35, 67, 27}
            Dim encryptKey As String = "aXb2uy4z"
            key = Encoding.UTF8.GetBytes(encryptKey)
            Dim byteInput As Byte() = Encoding.UTF8.GetBytes(inputString)
            Dim provider As New DESCryptoServiceProvider()
            memStream = New MemoryStream()
            Dim transform As ICryptoTransform = provider.CreateEncryptor(key, IV)
            Dim cryptoStream As New CryptoStream(memStream, transform, CryptoStreamMode.Write)
            cryptoStream.Write(byteInput, 0, byteInput.Length)
     
            cryptoStream.FlushFinalBlock()
     
        Catch ex As Exception
            Response.Write(ex.Message)
        End Try
     
        Return Convert.ToBase64String(memStream.ToArray())
    End Function
     
    Create two byte arrays for key and IV and set your key and IV. Call the GetBytes method to get the string as bytes. Create an instance of DESCryptoServiceProvider class. Create an instance of ICryptoTransform class and call the CreateEncryptor() method by providing secret Key and IV. Create instance of CryptoStream class by providing byte input, offset and length.  Call the FlushFinalBlock() method of CryptoStream class to update the currently buffered data to MemoryStream. At the end, return the Memory stream array by converting it to Base64 string.
     
  8. Add a button click event in code file of Default.aspx page to redirect to Page2.aspx

    C#
     
    protected void btnEncrypt_Click(object sender, EventArgs e)
    {
        string url = "Page2.aspx?";
        string queryString = "id=10&name=wayne";
        string encryptedQueryString = EncryptString(queryString);
        string urlWithEncryptedString = url + encryptedQueryString;
        Response.Redirect(urlWithEncryptedString);
    }
     
    VB.NET
     
    Protected Sub btnEncrypt_Click(ByVal sender As Object, ByVal e As EventArgs) Handles btnEncrypt.Click
        Dim url As String = "Page2.aspx?"
        Dim queryString As String = "id=10&name=wayne"
        Dim encryptedQueryString As String = EncryptString(queryString)
        Dim urlWithEncryptedString As String = url & encryptedQueryString
        Response.Redirect(urlWithEncryptedString)
    End Sub
     
    Call the EncryptString() method by providing query string and redirect the page to Page2.aspx.
     
  9. Add a function in code file of Page2.aspx for decryption
     
    C#
     
    public string DecryptString(string inputString)
    {
        MemoryStream memStream = null;
        try
        {
            byte[] key = { };
            byte[] IV = { 12, 21, 43, 17, 57, 35, 67, 27 };
            string encryptKey = "aXb2uy4z";
            key = Encoding.UTF8.GetBytes(encryptKey);
            byte[] byteInput = new byte[inputString.Length];
            byteInput = Convert.FromBase64String(inputString);
            DESCryptoServiceProvider provider = new DESCryptoServiceProvider();
            memStream = new MemoryStream();
            ICryptoTransform transform = provider.CreateDecryptor(key, IV);
            CryptoStream cryptoStream = new CryptoStream(memStream, transform, CryptoStreamMode.Write);
            cryptoStream.Write(byteInput, 0, byteInput.Length);
            cryptoStream.FlushFinalBlock();
        }
        catch (Exception ex)
        {
            Response.Write(ex.Message);
        }
     
        Encoding encoding1 = Encoding.UTF8;
        return encoding1.GetString(memStream.ToArray());
    }
     
    VB.NET
     
    Public Function DecryptString(ByVal inputString As String) As String
        Dim memStream As MemoryStream = Nothing
        Try
            Dim key As Byte() = {}
            Dim IV As Byte() = {12, 21, 43, 17, 57, 35, 67, 27}
            Dim encryptKey As String = "aXb2uy4z"
            key = Encoding.UTF8.GetBytes(encryptKey)
            Dim byteInput As Byte() = New Byte(inputString.Length - 1) {}
            byteInput = Convert.FromBase64String(inputString)
            Dim provider As New DESCryptoServiceProvider()
            memStream = New MemoryStream()
            Dim transform As ICryptoTransform = provider.CreateDecryptor(key, IV)
            Dim cryptoStream As New CryptoStream(memStream, transform, CryptoStreamMode.Write)
            cryptoStream.Write(byteInput, 0, byteInput.Length)
            cryptoStream.FlushFinalBlock()
        Catch ex As Exception
            Response.Write(ex.Message)
        End Try
     
        Dim encoding1 As Encoding = Encoding.UTF8
        Return encoding1.GetString(memStream.ToArray())
    End Function
     
    Decrypt query string by using same key and IV.  Convert the string from Base64 to byte array. Call the CreateDecryptor() method here by passing same key and IV. Create instance of CryptoStream class by providing byte input, offset and length.  Call the FlushFinalBlock() method of CryptoStream class to update the currently buffered data to MemoryStream. At the end, call GetString() method to get data from memory stream array. 
     
  10. Add a button click event in code file of Page2.aspx to display the decrypted query string

    C#
     
    protected void btnDecrypt_Click(object sender, EventArgs e)
    {
        string url = Request.RawUrl;
        string urlEnrypted = url.Substring(url.IndexOf('?') + 1);
        string decryptedUrl = DecryptString(urlEnrypted);
        lblURL.Text = decryptedUrl;
    }
     
    VB.NET

    Protected Sub btnDecrypt_Click(ByVal sender As Object, ByVal e As EventArgs) Handles btnDerypt.Click
        Dim url As String = Request.RawUrl
        Dim urlEnrypted As String = url.Substring(url.IndexOf("?") + 1)
        Dim decryptedUrl As String = DecryptString(urlEnrypted)
        lblURL.Text = decryptedUrl
    End Sub
     
    Get the raw URL of the current page and get the encrypted part of the URL which is query string parameters after question mark (?).
     
  11. Set Default.aspx page as Start Page and start debugging.  

 

   
Add Article Comment:
Name :
Email Address :
   
Comments :
 
   
<< Method Overloading and Overriding in ASP.NET

Disclaimer - Privacy
© 2002-2017 DevASP.net