Part 1: SharePoint : Think before You Pass Your Parameters in Query String Format

This blog will talk about while passing the parameters in Query String you should understand the Pros/Cons which you may lead to.

Introduction to Problem

Consider a case where you need to pass some user information as a query string parameter in URL which will be assessed in other page and used there to execute some code. Will you pass it straight away? What if user changes those parameter to some other value like Location=India to Location=Norway? That will give access to page which he should not get or will pass the wrong parameters to output page. This may result into issues in future; so basically user should not able to change this information in URL.

Best approach to get rid of this issue is to encrypt values and then decrypt. While passing the parameters in URL you should encrypt by using Encryption Key and then use the same key to decrypt those values at destination end.

Solution

Consider a case where you are passing parameters as: http://{YourSharePointSiteURL}/Sites/TestSite/Pages/TestPage.aspx?Location=India&User=SharePointUser so ideally you should encrypt these two parameters like India and SharePointUser before sending it to other end.

Please find below is the helper method to encrypt parameters:

using System.Security.Cryptography;

/// <summary>
/// method to encrypt the string
/// </summary>
/// <param name="clearText">simple string to encrypt</param>
/// <returns>encrypted string</returns>
public static string Encrypt(string clearText)
{
    string EncryptionKey = "MAKV2SPBNI99212";
    byte[] clearBytes = Encoding.Unicode.GetBytes(clearText);
    using (Aes encryptor = Aes.Create())
    {
        Rfc2898DeriveBytes pdb = new Rfc2898DeriveBytes(EncryptionKey, new byte[] { 0x49, 0x76, 0x61, 0x6e, 0x20, 0x4d, 0x65, 0x64, 0x76, 0x65, 0x64, 0x65, 0x76 });
        encryptor.Key = pdb.GetBytes(32);
        encryptor.IV = pdb.GetBytes(16);
        using (MemoryStream oMemoryStream = new MemoryStream())
        {
            using (CryptoStream oCryptoStream = new CryptoStream(oMemoryStream, encryptor.CreateEncryptor(), CryptoStreamMode.Write))
            {
                oCryptoStream.Write(clearBytes, 0, clearBytes.Length);
                oCryptoStream.Close();
            }
            clearText = Convert.ToBase64String(oMemoryStream.ToArray());
        }
    }
    return clearText;
}

Here is how you will be calling this method:

string Location = "SharepointUserLocation";
string LoggedInUser = "SharepointUser";

string EncryptedLocation = Encrypt(HttpUtility.UrlEncode(Location .Trim()));
string EncryptedLoggedInUser = Encrypt(HttpUtility.UrlEncode(LoggedInUser.Trim()));

string Encrypted =  string.Format("~/page.aspx?Location={0}&LoggedInUser={1}", EncryptedLocation , EncryptedLoggedInUser);

Happy SharePointing!!!