Menus

Sunday, May 1, 2016

Encrypt and Decrypt Query string parameters in ASP.Net C#

The QueryString Parameter values will be first encrypted using AES Symmetric key (Same key) algorithm, encoded (as the encrypted output might contain some special characters) and then will be sent to next page. On the destination page the QueryString Parameter values will be first decoded and then decrypted using AES Algorithm using the same key that was used for encryption.

First Step 1:
Import the below namespace
using System.Security.Cryptography;

Encrypting the QueryString Parameter Values
When the Button is clicked the following event handler is executed. Here the values of the TextBox and the DropDownList are first encrypted using the AES Symmetric Key Algorithm and then encoded using the UrlEncode method of the HttpUtility class. Finally these values are sent as QueryString Parameters to the next page.

protected void Submit(object sender, EventArgs e)
{
    string name = HttpUtility.UrlEncode(Encrypt(TextBox1.Text.Trim()));
    string technology = HttpUtility.UrlEncode(Encrypt(DropdownList1.SelectedItem.Value));
    Response.Redirect(string.Format("~/CS2.aspx?name={0}&technology={1}", name, technology));
}

private string Encrypt(string clearText)
{
    string EncryptionKey = "NBLU1TPNB087323";
    byte[] clearBytes = Encoding.Unicode.GetBytes(clearText);
    using (Aes encryptor = Aes.Create())
    {
        Rfc2898DeriveBytes pdb = new Rfc2898DeriveBytes(EncryptionKey, new byte[] { 0x49, 0x76, 0x61, 0x6e, 0x20, 0x4d, 0x65, 0x64, 0x76, 0x65, 0x64, 0x65, 0x76 });
        encryptor.Key = pdb.GetBytes(32);
        encryptor.IV = pdb.GetBytes(16);
        using (MemoryStream ms = new MemoryStream())
        {
            using (CryptoStream cs = new CryptoStream(ms, encryptor.CreateEncryptor(), CryptoStreamMode.Write))
            {
                cs.Write(clearBytes, 0, clearBytes.Length);
                cs.Close();
            }
            clearText = Convert.ToBase64String(ms.ToArray());
        }
    }
    return clearText;
}

Decrypting the QueryString Parameter Values
In the Page Load event of the page, the values of the TextBox and DropDownList sent from the previous page are first fetched from the QueryString Parameters and then are decoded using the UrlDecode method of the HttpUtility class.
After decoding the string is decrypted using the AES Symmetric Key Algorithm and then the decrypted values are displayed using Label controls
protected void Page_Load(object sender, EventArgs e)
{
    if (!this.IsPostBack)
    {
        lblName.Text = Decrypt(HttpUtility.UrlDecode(Request.QueryString["name"]));
        lblTechnology.Text = Decrypt(HttpUtility.UrlDecode(Request.QueryString["technology"]));
    }
}

private string Decrypt(string cipherText)
{
    string EncryptionKey = "NBLU1TPNB087323";
    cipherText = cipherText.Replace(" ", "+");
    byte[] cipherBytes = Convert.FromBase64String(cipherText);
    using (Aes encryptor = Aes.Create())
    {
        Rfc2898DeriveBytes pdb = new Rfc2898DeriveBytes(EncryptionKey, new byte[] { 0x49, 0x76, 0x61, 0x6e, 0x20, 0x4d, 0x65, 0x64, 0x76, 0x65, 0x64, 0x65, 0x76 });
        encryptor.Key = pdb.GetBytes(32);
        encryptor.IV = pdb.GetBytes(16);
        using (MemoryStream ms = new MemoryStream())
        {
            using (CryptoStream cs = new CryptoStream(ms, encryptor.CreateDecryptor(), CryptoStreamMode.Write))
            {
                cs.Write(cipherBytes, 0, cipherBytes.Length);
                cs.Close();
            }
            cipherText = Encoding.Unicode.GetString(ms.ToArray());
        }
    }
    return cipherText;
}