encrypting / encoding login info within a URL

[hellrazor]

Hi there,

We want to be able to encrypt the user ID and password within a URL, so
when we send the URL via email, they'll be able to click said URL, and the
aspx page should be able to decode it and authenticate it.

I'm thinking the url would look something like this:

http://localhost/login.aspx?id=af3awfalj3o3i3ok0890

When decoding the "id" part, the decoding function should be able to decode
/ decrypt the user id and password, authenticate with the DB and continue.


Could anyone point me in the right direction in udertaking something like
this?

it doesn't matter if the solution is in c# or vb



Thanks!


Jorge

 

[Peter Rilling]

And you expect this to be a secured system? If the message is intercepted,
or passed around, then anyone can access the system.

You should look into using some for of server authentication such as
FormsAuthentication or Integrated Security. Send the URL to anyone that
wants it, but then when they click it, the site should prompt for
credentials. Once authenticated, then the site could redirect to the URL
from the link.

If, however, the link will be given to people who would be considered guests
with no credentials in the system, then you should architected some isolated
area such as some sites have where the owner of content can make it public
to a select group. The guests might have their own credentials or the area
would simply be publicly accessible.

Sorry to be so blunt, but if the username and password is part of the URL,
you have essentially given that information to all people in the world.

 

[hellrazor]

And you expect this to be a secured system? If the message is
intercepted, or passed around, then anyone can access the system.

You should look into using some for of server authentication such as
FormsAuthentication or Integrated Security. Send the URL to anyone
that wants it, but then when they click it, the site should prompt for
credentials. Once authenticated, then the site could redirect to the
URL from the link.

If, however, the link will be given to people who would be considered
guests with no credentials in the system, then you should architected
some isolated area such as some sites have where the owner of content
can make it public to a select group. The guests might have their own
credentials or the area would simply be publicly accessible.

Sorry to be so blunt, but if the username and password is part of the
URL, you have essentially given that information to all people in the
world.

Hi,

To answer your question: NO, I do not expect this to be a secure system
at all. The data we're guarding does not warrant a higher level of
security. They simply want security by obscurity so the URL to not
outright display the user id and pw as it currently does:

http://localhost/login.aspx?id=blah&pw=yes

They are aware that whoever has the link can log in.

Originally I had server authentication, but they changed the requirements
so that they can log in just by clicking the url.

dang, even encoding the id/pw with rot-13 could work, but I'll take a
look at md5 and these other encoding algorithms (of which I know nothing
about!)

I agree with the rest of your email, but it's not the answer to my
problem.

thanks for the reply though