Securing The URL Parameter/Sensitive Data Using .Net Core DataProtectorTokenProvider

Today, Web and data security has become a major concern to most of the enterprises. It is important for Web developers to build websites to secure sensitive data and not expose it to the outside world or unauthorized people. I’m sure as a developer, you may come across URLs where some parameters are passed in the URL to indentify users and other parameters values.

For example,

Now, the question is can we encrypt this id to some non-readable format for the outer world and use it decrypted format for internal within calling code which is finally compiled to some DLL or EXE.

For example,

This will surely help us to prevent sensitive data from being misused, let's jump to code snippets in order to understand the development approach, here we will use the inbuilt feature of .NET core DataProtectorTokenProvider. It will take care of encrypting and decrypting our private data (Query Parameter) or any other sensitive data.

In .NET Core, each service, middleware, class, and interface handled through dependency injection. this is why DI is used properly using scoped, singleton, transient. let's create a custom class with CustomIDataProtector.cs define the encode and decode methods which will use internally use Protect() and Unprotect() methods of IDataProtector interface.

namespace DemoDecodeURLParameters.Security {
public class CustomIDataProtection {
private readonly IDataProtector protector;
public CustomIDataProtection(IDataProtectionProvider dataProtectionProvider, UniqueCode uniqueCode) {
protector = dataProtectionProvider.CreateProtector(uniqueCode.BankIdRouteValue);
}
public string Decode(string data) {
return protector.Protect(data);
}
public string Encode(string data) {
return protector.Unprotect(data);
}
}
}

Register this class in the .NET core DI container. We also added Uniquecode it's your secret key to make additional security we need the same key for protecting and unprotect your sensitive data.

public class UniqueCode {
public readonly string BankIdRouteValue = "BankIdRouteValue";
}
public void ConfigureServices(IServiceCollection services) {
services.AddSingleton < UniqueCode > ();
services.AddSingleton < CustomIDataProtection > ();
}

Let's use CustomIDataProtection this in .Net core pages

public class IndexModel: PageModel {
private readonly CustomIDataProtection protector;
public IndexModel(CustomIDataProtection customIDataProtection) {
protector = customIDataProtection;
}
public void OnGet() {
DomainModel dm = new DomainModel();
dm.BankId = 2020202020;
dm.DecodeId = protector.Decode(dm.BankId.ToString());
ViewData["BankData"] = dm;
}
}

Here is an .cshtml file for reference

@page
@model IndexModel
@{
ViewData["Title"] = "Home page";
var bankData = ViewData["BankData"] as DemoDecodeURLParameters.Security.DomainModel;
}
<div class="text-center">
<h1 class="display-4">Welcome to RTMoney BanK</h1>
<p>Learn about <a href="https://docs.microsoft.com/aspnet/core">building Web apps with ASP.NET Core</a>.</p>
<div class="card-footer text-center">
<b> URL Query Parameter Decode & Encode using IDataProtectionProvider </b> <a asp-page="/Privacy"
asp-route-id="@bankData.DecodeId" class="btn btn-primary m-1">View Page</a>
</div>
</div>

Let's have a look at UI page now

In this screen(Without Data Protection), we have given the View Page(Link Button) button once you click it will redirect to the details Privacy page and pass Id as URL query parameter, you check the same on mouse over that link button and Id is easily visible.

With Data Protection, as you can see now the Id got converted to some non-readable data format as seen on below,

Let's go ahead and click on View Page and read this non-readable format using the encode method and see the results.

Here is a code snippet of Privacy.cshtml.cs - as you can see, we are encoding the decoded value passed from URL,

public class PrivacyModel: PageModel {
private readonly CustomIDataProtection protector;
public PrivacyModel(CustomIDataProtection customIDataProtection) {
protector = customIDataProtection;
}
public void OnGet(string id) {
ViewData["BDId"] = protector.Encode(id);
}
}

Privacy.cshtml content, here we displayed the encoded value: 2020202020

@page
@model PrivacyModel
@{
ViewData["Title"] = "Privacy Policy";
}
<h1>@ViewData["Title"]</h1>
<p>Bank Account No @ViewData["BDId"]</p>
<p>Use this page to detail your site's privacy policy.</p>

Conclusion

We can decode and encode any parameters which are being passed as part of the URL data or query string. We can utilize this DataProtectorTokenProvider in below scenarios

HTTP GET Verb parameters
URL Query string
Any Sensitive data like Service Password/ Account Key's / Database details
Connection strings etc

Please find the code reference Github.

3 Comments

Join the conversation! Your thoughts help the community grow.

nitin patil5y ago
This in nice article. I think Encode and decode functions are written incorrectly.It should be, public string Decode(string data) { return protector.Unprotect(data); } public string Encode(string data) { return protector.Protect(data); }
- HIMANSHU Pathak4y ago
  Yes you are right.... :) it works for me
Sourav Kumar Das6y ago
Nice Article.