ASP.NET中的CustomerId和Request.QueryString

Question

Request.QueryString is not very safe. Incase someone is logged in. Just by typing in the URL

myaccount.aspx?custId=10

One can get the information of another Customer.

So its not safe at all. The reason for posting this was because, I wanted an alternative way of passing customerId between pages. Perhaps encrypt it?

Answer 1

Query strings are safe and are not flawed .

What is flawed and unsafe is trusting user input data. It is your responsibility to verify the data being sent to the server is not malicious and that the requested action is allowed for the logged in user.

You should take that query stirng value, make sure it is the valid type (your example appears to be an integer) and then before fetching the customer's data, make sure the user is allowed to access that customers data.

Answer 2

Really for myaccount.aspx you shouldn't need to a user to pass their ID in as a parameter.

As others have said, use Membership. Or create a hash (an encypted value) of a user's ID and password and save that as a cookie or in the session object. You can read that instead of an input parameter.

Answer 3

That's not the responsibility of the QueryString . You should implement an authenication and authorization system, preferably with a MembershipProvider and RolesProvider .

Answer 4

It does what it's supposed to do. It is up to you to secure your site. No one said everything in the querystring is used for sensitive access related functionality.

Answer 5

There is no safe way to pass it. Once the user has logged in, store the ID in Session or something equivalent, then always take it from there.

Answer 6

您可以查看asp.net会员资格

Answer 7

您应该使用ASP.NET 安全性对客户进行身份验证和授权，以便检查登录用户是否可以访问查询字符串中指定的客户ID。