Saving QueryString to protect URL manipulation

Question

Is there a way to save the querystring ids after the page load? the reason why i am looking is that ...i should be back and forth with pages and more importantly if the user try to manupluate the ids then it should not effect the result of my page since i will be reading the Ids not from querystring but from some save prop or something like that.

for an example: let says the page loads very first time... i have this url:

http://www.somesite.com/Shop/Product/Detail.aspx?ProductId=100 

and if the user try to modify the querystirng and re-load the page then the page_load should not read from querystring rather from saved prop or something???

Answer 1

In your page load event look at the Page.IsPostBack property. It is false when a page is first loaded. You should validate your parameters then and perhaps save them to session or viewstate.

If Page.IsPostback = false Then
    'Validate Request("ProductID") here
    'Save in viewstate or session state
Else
    'Retrieve ProductID from viewstate or session state
End If

If a user changes the query string, you should consider it a new page load.

Answer 2

This would not work since it's against the very basic nature of Internet. Internet is stateless.

Everytime user changes the querystring, it will be treated as a new Url, storing the parameters will be of no use. Page.IsPostback won't work either since every Url change will be a first hit.

Saying that, you can still work around it,

1. With every Url, you can pass a unique identifier (like a GUID.)

2. As soon as page hits, you can save parameters in session and work with them and use the Guid to map the two requests.

But the problem remains here, if the user changes that Guid then again it will be treated as a new request. You can go one step ahead and start saving that GUID to make sure that only system generated GUIDs are handled but overall it will just make your system complex.

My guess is that you might be looking at a wrong solution for your problem. If you can share your actual aim then we might be able to recommend you something more tangible.

Answer 3

You can not stop users from editing querystring values and trying to see content of another page or execute something. what you can do is you can check in the page load that this user has sufficient permission to access this page.

Ex : www.mysite.com/editproduct.aspx?productid=4

In editproduct.aspx, you have to check whether the product 4 has access by the current user who is accessing the page.( May he should be the creator/ he should be in a specific power users group etc... depending upon your scenario). If he has access, show the edit form to the user, else hide it and show a message saying "you are not authorized to access this resource."

Answer 4

There is no way; however, you can use session to validate when the Page_load is called.

If ( Page.isPostBack = true ) {
    Session("SAVE") = false;
}

For a while in the before the Request.Querystring statement, you validate the 'save' session state.