如何隐藏来自 shell 脚本的 email 中发送的 URL 中的查询参数

Question

I'm writing a shell script that will send email which has a link for application. When the user click link on the email, it will open the application. How to hide query parameters in the URL that was sent from shell script?

Answer 1

It doesn't make sense to hide URL / query string in any way; since if the user can open the URL, then the user must be able to read the URL. When you show that you have something to hide, curious users WILL try to find what and why are you hiding things.

sensitive information (confidential)

If what you're doing is sending something sensitive (ex: password), then just don't send it via email. Instead send some one-time-use token that expire after a day (assuming your email recipient will always read your email in a day). Format of such token can be JWT (see https://jwt.io for reference). For example:

instead of: click here to login: https://yourapp.com/login?username=user&pass=user123

use these: click here to login: https://yourapp.com/login?username=user&token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1c2VyIiwiaWF0IjoxNTE2MjM5MDIyLCJleHAiOjE1MTY0MzkwMjJ9.WkfqJZ3t0basNIqnRJD8R720BXmULhEONNlpHVxgoqA

Make sure you signed the JWT with a private key that only you know.

This way you're not exposing user's password just to prove that you're that user. The JWT in my example only contains claim that bearer of this token is named "user", and the token only valid from "iat" to "exp" field. (try copy-pasting the JWT above to jwt.io or decode it yourself).

If you're using this approach, you must also tell the users not to share their URL since other may impersonate them if they do.

identity

If what you're doing is sending something to prove who the user is, and it would be bad to be seen by other people because if they see it they can impersonate the recepient user, then you can send some hashed salt of the user's username or id. For example:

instead of: click here to login: https://yourapp.com/login?username=user

use these: click here to login: https://yourapp.com/login?username=3f480e2ceaf459b732f07b1b60a7ea16d1cd3244ef390ade01f401ad7b170445e08fb0b3583bb66210efc0fbe747c730f36f962de3cac07e6a165a80cb84def6

The hash in my example is sha512 digest of user some long long salt here 123 some long long salt here 123 some long long salt here 123 some long long salt here 123 some long long salt here 123 some long long salt here 123 some long long salt here 123 some long long salt here 123 some long long salt here 123

When your application read those hash, it can do a query to it's database like SELECT... WHERE $urlparam = SHA512( CONCAT( username, '$salt' ) )

Same with above approach, you must also tell the users not to share their URL since other may impersonate them if they do.

long / large data

If what you're doing is sending very long/large data, and/or you do not want the user to change that data (ex: shopping cart data). Then you have to save it into database instead, and only send primary key / id of the record in URL. For example:

instead of: click here to checkout: https://yourapp.com/checkout?username=user&cart1=myproduct1&cart1qty=20&cart2=myproduct2&cart2qty=50&cart3=myproduct3&cart3qty=99&cart4=myproduct4&cart4qty=1...(still continue)

use these: click here to checkout: https://yourapp.com/checkout?cartid=1372384

This way, even if the user knows that his/her cartid is 1372384, it doesn't means anything for him/her. Of course this approach should be combined with some means of authenticating the user (otherwise some malicious user can see other's cart by entering random number or by guessing it)

lazy answer

If you just want to hide the URL no matter why, just use some strong encryption algorithm like AES256 to encrypt all query parameter, and then encode it as base64 (or url safe base64). In this case, your application (that read/handle the URL) and your script that generates the URL will have to share a same encryption key.

You will probably end up with something like: click here to do something: https://yourapp.com/handle?ciphertext=ZTZKU1RFUmZqNTZrSWszeWYwaEtiM0RWVzRRNWlFcE1lalpCbWFBM3Z5TEY1R0xYdGprVDRsSmk5Nzc4Y3dXamJ4RUpLYmRxZ2RXS0lLM01oMUc1U0t2dUFlWktldERoVHdzcjl6SS9CMmZuRmtoQnBMVmtEeFFhaXhIUHZwVFM2MlQ0SURRZEpMNzZ0bUptN2p3M0VuT0tMME15RW8xcG5ZSW5hcnpFUm1qSlBWWEhEYVNMcU42VFd5WFdDWmFsQXJaWDNpT0xrMWhpNFN2aXI3RjE4dz09