Question

我需要在ASP.NET中加密和解密查询字符串。

查询字符串可能如下所示：

http://www.mysite.com/report.aspx?id=12345&year=2008

如何加密整个查询字符串，使其看起来如下所示？

http://www.mysite.com/report.aspx?crypt=asldjfaf32as98df8a

然后，当然，如何解密它？什么是最好的加密用于这样的事情？ TripleDes的？

Answer 1

这是一种在VB中执行此操作的方法：http://www.devcity.net/Articles/47/1/encrypt_querystring.aspx

加密代码的包装器：将查询字符串参数传递给此，并更改密钥!!!

Private _key as string = "!#$a54?3"
Public Function encryptQueryString(ByVal strQueryString As String) As String
    Dim oES As New ExtractAndSerialize.Encryption64()
    Return oES.Encrypt(strQueryString, _key)
End Function

Public Function decryptQueryString(ByVal strQueryString As String) As String
    Dim oES As New ExtractAndSerialize.Encryption64()
    Return oES.Decrypt(strQueryString, _key)
End Function

加密代码：

Imports System
Imports System.IO
Imports System.Xml
Imports System.Text
Imports System.Security.Cryptography

Public Class Encryption64
    Private key() As Byte = {}
    Private IV() As Byte = {&H12, &H34, &H56, &H78, &H90, &HAB, &HCD, &HEF}

    Public Function Decrypt(ByVal stringToDecrypt As String, _
        ByVal sEncryptionKey As String) As String
        Dim inputByteArray(stringToDecrypt.Length) As Byte
         Try
            key = System.Text.Encoding.UTF8.GetBytes(Left(sEncryptionKey, 8))
            Dim des As New DESCryptoServiceProvider()
            inputByteArray = Convert.FromBase64String(stringToDecrypt)
            Dim ms As New MemoryStream()
            Dim cs As New CryptoStream(ms, des.CreateDecryptor(key, IV), _
                CryptoStreamMode.Write)
            cs.Write(inputByteArray, 0, inputByteArray.Length)
            cs.FlushFinalBlock()
            Dim encoding As System.Text.Encoding = System.Text.Encoding.UTF8
            Return encoding.GetString(ms.ToArray())
        Catch e As Exception
            Return e.Message
        End Try
    End Function

    Public Function Encrypt(ByVal stringToEncrypt As String, _
        ByVal SEncryptionKey As String) As String
        Try
            key = System.Text.Encoding.UTF8.GetBytes(Left(SEncryptionKey, 8))
            Dim des As New DESCryptoServiceProvider()
            Dim inputByteArray() As Byte = Encoding.UTF8.GetBytes( _
                stringToEncrypt)
            Dim ms As New MemoryStream()
            Dim cs As New CryptoStream(ms, des.CreateEncryptor(key, IV), _
                CryptoStreamMode.Write)
            cs.Write(inputByteArray, 0, inputByteArray.Length)
            cs.FlushFinalBlock()
            Return Convert.ToBase64String(ms.ToArray())
        Catch e As Exception
            Return e.Message
        End Try
    End Function

End Class

Answer 2

使用AES加密在C＃中加密 -

protected void Submit(object sender, EventArgs e)
{
    string name = HttpUtility.UrlEncode(Encrypt(txtName.Text.Trim()));
    string technology = HttpUtility.UrlEncode(Encrypt(ddlTechnology.SelectedItem.Value));
    Response.Redirect(string.Format("~/CS2.aspx?name={0}&technology={1}", name, technology));
}

AES算法加密和解密功能

private string Encrypt(string clearText)
{
    string EncryptionKey = "hyddhrii%2moi43Hd5%%";
    byte[] clearBytes = Encoding.Unicode.GetBytes(clearText);
    using (Aes encryptor = Aes.Create())
    {
        Rfc2898DeriveBytes pdb = new Rfc2898DeriveBytes(EncryptionKey, new byte[] { 0x49, 0x76, 0x61, 0x6e, 0x20, 0x4d, 0x65, 0x64, 0x76, 0x65, 0x64, 0x65, 0x76 });
        encryptor.Key = pdb.GetBytes(32);
        encryptor.IV = pdb.GetBytes(16);
        using (MemoryStream ms = new MemoryStream())
        {
            using (CryptoStream cs = new CryptoStream(ms, encryptor.CreateEncryptor(), CryptoStreamMode.Write))
            {
                cs.Write(clearBytes, 0, clearBytes.Length);
                cs.Close();
            }
            clearText = Convert.ToBase64String(ms.ToArray());
        }
    }
    return clearText;
}


private string Decrypt(string cipherText)
{
    string EncryptionKey = "hyddhrii%2moi43Hd5%%";
    cipherText = cipherText.Replace(" ", "+");
    byte[] cipherBytes = Convert.FromBase64String(cipherText);
    using (Aes encryptor = Aes.Create())
    {
        Rfc2898DeriveBytes pdb = new Rfc2898DeriveBytes(EncryptionKey, new byte[] { 0x49, 0x76, 0x61, 0x6e, 0x20, 0x4d, 0x65, 0x64, 0x76, 0x65, 0x64, 0x65, 0x76 });
        encryptor.Key = pdb.GetBytes(32);
        encryptor.IV = pdb.GetBytes(16);
        using (MemoryStream ms = new MemoryStream())
        {
            using (CryptoStream cs = new CryptoStream(ms, encryptor.CreateDecryptor(), CryptoStreamMode.Write))
            {
                cs.Write(cipherBytes, 0, cipherBytes.Length);
                cs.Close();
            }
            cipherText = Encoding.Unicode.GetString(ms.ToArray());
        }
    }
    return cipherText;
}

解密

lblName.Text = Decrypt(HttpUtility.UrlDecode(Request.QueryString["name"]));
lblTechnology.Text = Decrypt(HttpUtility.UrlDecode(Request.QueryString["technology"]));

Answer 3

我无法从头顶解决问题，但你应该避免使用TripleDES，因为它是not as secure as other encryption methods。

如果我这样做，我只需将整个网址（域名和查询字符串）作为URI object，然后使用built-in .NET libraries之一加密，并将其作为{{1}提供对象。当我需要对其进行解密时，请执行此操作，然后创建一个新的URI对象，这样可以让您从原始查询字符串中取出所有内容。

Answer 4

以上是Brian的上述示例中的解密函数的一种奇特版本，如果您只是将其用于QueryString，则可以使用它，因为它返回NameValueCollection而不是字符串。它还包含一个轻微的修正，因为布莱恩的例子将在没有

的情况下破裂

stringToDecrypt = stringToDecrypt.Replace(" ", "+")

如果要解密的字符串中有任何“空格”字符：

Public Shared Function DecryptQueryString(ByVal stringToDecrypt As String, ByVal encryptionKey As String) As Collections.Specialized.NameValueCollection
    Dim inputByteArray(stringToDecrypt.Length) As Byte
    Try
        Dim key() As Byte = System.Text.Encoding.UTF8.GetBytes(encryptionKey.Substring(0, encryptionKey.Length))
        Dim IV() As Byte = {&H12, &H34, &H56, &H78, &H90, &HAB, &HCD, &HEF}
        Dim des As New DESCryptoServiceProvider()
        stringToDecrypt = stringToDecrypt.Replace(" ", "+")
        inputByteArray = Convert.FromBase64String(stringToDecrypt)
        Dim ms As New MemoryStream()
        Dim cs As New CryptoStream(ms, des.CreateDecryptor(key, IV), CryptoStreamMode.Write)
        cs.Write(inputByteArray, 0, inputByteArray.Length)
        cs.FlushFinalBlock()
        Dim encoding As System.Text.Encoding = System.Text.Encoding.UTF8
        Dim decryptedString As String = encoding.GetString(ms.ToArray())
        Dim nameVals() As String = decryptedString.Split(CChar("&"))
        Dim queryString As New Collections.Specialized.NameValueCollection(nameVals.Length)
        For Each nameValPair As String In nameVals
            Dim pair() As String = nameValPair.Split(CChar("="))
            queryString.Add(pair(0), pair(1))
        Next
        Return queryString

    Catch e As Exception
        Throw New Exception(e.Message)
    End Try
End Function

我希望你觉得这很有用！

Answer 5

我最初同意Joseph Bui，理由是使用POST方法会提高处理器效率，Web标准规定如果请求不是在服务器上更改数据，则应使用GET方法

加密数据的代码要比使用POST要多得多。

Answer 6

为什么要尝试加密查询字符串？如果数据敏感，则应使用SSL。如果您担心某人正在查看用户的肩膀，请使用表单POST而不是GET。

我认为除了加密查询字符串之外，很有可能为您的基本问题提供更好的解决方案。

如何加密asp.net中的查询字符串？

6 个答案: