Securing URL ids in .NET MVC Project

Question

On our app we use secure function that make id in the road in other way:

We have for example: http://some.com/controller/action/12
In secure it will be: http://some.com/controller/action/bs16gz

We need to impelement auto securing (read: do not secure and unsecure Id in each controller). So it should be general solution what will be automatically implemented in all application.

Any ideas?

----Why we need it?-----
We want to prevent user to change id in QueryString for looking into another item

Exmaple:http://some.com/controller/action/12 is one record, then user change id to 13 and see another record. It's needs to our system to prevent this actions.

If user isn't permitted to view the record, then "securing" ids is a hack and you should think of a proper authorization routine — user338195
– user338195, Commented Oct 13, 2011 at 12:06

Anton Gogolev · Accepted Answer · 2011-10-13 11:25:54Z

4

I wonder why would you need that. If you don't want someone "in the middle" to see these IDs, secure your HTTP traffic with SSL. If you don't want users to access other users' content, put security in place.

But if you're still after securing IDs, I think model binders is the way to go:

class MyController 
{
    ActionResult Index(SecureID id) 
    {
        var resource = ResourceRepository.Get<Resource>(id); // implicit conversion to long

answered Oct 13, 2011 at 11:25

Anton Gogolev

116k39 gold badges204 silver badges293 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Evgeniy Labunskiy Over a year ago

Thanks! This is good idea, i will test it. I have to other ideas (just ideas) - 1. override route (get secure id, return int), 2. at global.asax use OnBeginRequest hendler. How do you think, is it good ideas?

Hector Correa Over a year ago

@Evgeniy Labunskiy: I would rather follow Anton's advise than the two options that you indicated. Even if they were to work, they smell bad.

Collectives™ on Stack Overflow

Securing URL ids in .NET MVC Project

1 Answer 1

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related