加密查询字符串，包括密钥

Question

我有一个应用程序使用查询字符串在页面周围传递一些值。我发现了一些关于如何加密查询字符串中的值的示例，但问题是我的 KEYS 更多地了解了查询字符串，然后是所有整数转换为字符串的值。

有没有办法加密 ASP.NET 中的整个查询字符串，包括键和键值？

类似：

Default.aspx?value1=40&value2=30&value3=20

到

 Default.aspx?56sdf78fgh90sdf4564k34klog5646l

谢谢！

Answer 1

上面的许多参考资料都忽略了一个问题，那就是在返回加密字符串之前，URL 编码（在字符串返回之前见下文）。我使用的是 IIS 7.5，它会自动为你“解码”字符串，所以解密“应该”没问题。加密和解密代码如下所示。

public string EncryptQueryString(string inputText, string key, string salt)
{
    byte[] plainText = Encoding.UTF8.GetBytes(inputText);

    using (RijndaelManaged rijndaelCipher = new RijndaelManaged())
    {
        PasswordDeriveBytes secretKey = new PasswordDeriveBytes(Encoding.ASCII.GetBytes(key), Encoding.ASCII.GetBytes(salt));
        using (ICryptoTransform encryptor = rijndaelCipher.CreateEncryptor(secretKey.GetBytes(32), secretKey.GetBytes(16)))
        {
            using (MemoryStream memoryStream = new MemoryStream())
            {
                using (CryptoStream cryptoStream = new CryptoStream(memoryStream, encryptor, CryptoStreamMode.Write))
                {
                    cryptoStream.Write(plainText, 0, plainText.Length);
                    cryptoStream.FlushFinalBlock();
                    string base64 = Convert.ToBase64String(memoryStream.ToArray());

                    // Generate a string that won't get screwed up when passed as a query string.
                    string urlEncoded = HttpUtility.UrlEncode(base64);
                    return urlEncoded;
                }
            }
        }
    }
}

public string DecryptQueryString(string inputText, string key, string salt)
        {
            byte[] encryptedData = Convert.FromBase64String(inputText);
            PasswordDeriveBytes secretKey = new PasswordDeriveBytes(Encoding.ASCII.GetBytes(key), Encoding.ASCII.GetBytes(salt));

            using (RijndaelManaged rijndaelCipher = new RijndaelManaged())
            {
                using (ICryptoTransform decryptor = rijndaelCipher.CreateDecryptor(secretKey.GetBytes(32), secretKey.GetBytes(16)))
                {
                    using (MemoryStream memoryStream = new MemoryStream(encryptedData))
                    {
                        using (CryptoStream cryptoStream = new CryptoStream(memoryStream, decryptor, CryptoStreamMode.Read))
                        {
                            byte[] plainText = new byte[encryptedData.Length];
                            cryptoStream.Read(plainText, 0, plainText.Length);
                            string utf8 = Encoding.UTF8.GetString(plainText);
                            return utf8;
                        }
                    }
                }
            }
        }

Answer 2

网上有很多例子。

其中一些：

How can I encrypt a querystring in asp.net?

how to pass encrypted query string in asp.net

http://www.codeproject.com/Articles/33350/Encrypting-Query-Strings

http://www.keyvan.ms/how-to-encrypt-query-string-parameters-in-asp-net

http://forums.asp.net/t/989552.aspx/1

现在你说你也喜欢加密密钥，实际上你要做的就是加密它们所有的 url 行，然后你只需 阅读 RawUrl 之后的内容是什么？并解密。