0

I am building a .Net app that effectively has news articles, some of which are available publicly and some of which are only available when you're logged in.

The URL to each article needs to include the article's ID in some way and until now I've been using AES to encrypt the article ID, using the user's ID as the 'shared secret' and an 8 digit string as salt.

e.g. /article.aspx?id=EvEAAAACtp2iEc7lKyJSu6382Ryl4k571L5/PQrJYY1JJfeq4F

The problem is that if the user views an article while logged in, they won't be able to copy the URL and send it on to anyone else as it won't work with another user's ID or with a non-logged-in user.

What's the right approach for including IDs in query strings (or anywhere else for that matter) when they need to be shared among known/unknown users?

Thanks.

4

2 回答 2

1

以明文形式传递查询字符串上的 id 并让 Web 服务器检查客户端是否有足够的凭据来阅读该文章并做出适当的反应不是更安全吗？它甚至可以返回相关的 HTTP 状态码 (401) 表示您需要登录，或者返回 403 表示您看不到它。

于 2012-08-15T15:17:16.657 回答
0

执行此操作的一种常见方法是使用“链接”或“共享”按钮生成某人可以通过电子邮件发送的链接。

于 2012-08-15T15:15:14.130 回答