Help me secure this site (please?)

[MattB]

Not sure if this is a good approach or not, but I'd like to hear some
informed opinions. I've designed an ECommerce site that interfaces with my
company's POS system. I'm trying to make it as flexible as possible because
we resell it to our clients and they all have different needs and
preferences.
So the items for sale are displayed in a datagrid, and in the
ItemDataBound event, I construct a URL with query strings so that when an
item is selected, the next page knows what item was chosen. The query string
seemed like a good way to go because it works well from the datagrid, and it
makes the system more open, so that a client can send out something like an
"email special" with the URL of an item with a special price that wouldn't
show up in the normal item list. This openness also creates a security risk,
because a hacker could look at the query strings being passed and start
guessing at other items they don't see in the item list and maybe buy
something the client didn't want to sell (like free stuff).
So I want to lock this down by having a list of items the client needs
to generate that they would sell that don't appear in the regular item list,
and have any other non-regular items be denied.
I was thinking that I'd set a session variable as the user leaves the
item list page that says what item was selected. Then, on the next page
(item details) if the query string matches the session variable, then they
can proceed. If it doesn't, the list of allowed hidden items is checked, and
the user can proceed only if their item is on that list. I'm not sure how to
set this session variable since I leave my item list with a link instead of
an event. Is there an even that fires as I leave that page that would allow
me to capture the URL being used and set a session variable? Is there a
different approach I should be looking into? I appreciate anyone with the
patience to have read this far and look forward to your suggestions. Thanks!

Matt

[Brad Quinn]

Instead of constructing a URL you could use a TemplateColumn with a
LinkButton that has the CommandName attribute set to "ViewItemDetails", for
instance. Then wire up the ItemCommand event for the DataGrid. You can then
construct the URL in the event handler, set a session variable, and do a
Response.Redirect.

However this isn't really going to solve your problem.

If you want to be able to mail out a link to the item details page, you have
a problem in that there isn't an easy way to authenticate the user.

Without authenticating the user the only thing I can think of is possibly
signing or encrypting the query string.
"MattB" wrote:

Not sure if this is a good approach or not, but I'd like to hear some
informed opinions. I've designed an ECommerce site that interfaces with my
company's POS system. I'm trying to make it as flexible as possible because
we resell it to our clients and they all have different needs and
preferences.
So the items for sale are displayed in a datagrid, and in the
ItemDataBound event, I construct a URL with query strings so that when an
item is selected, the next page knows what item was chosen. The query string
seemed like a good way to go because it works well from the datagrid, and it
makes the system more open, so that a client can send out something like an
"email special" with the URL of an item with a special price that wouldn't
show up in the normal item list. This openness also creates a security risk,
because a hacker could look at the query strings being passed and start
guessing at other items they don't see in the item list and maybe buy
something the client didn't want to sell (like free stuff).
So I want to lock this down by having a list of items the client needs
to generate that they would sell that don't appear in the regular item list,
and have any other non-regular items be denied.
I was thinking that I'd set a session variable as the user leaves the
item list page that says what item was selected. Then, on the next page
(item details) if the query string matches the session variable, then they
can proceed. If it doesn't, the list of allowed hidden items is checked, and
the user can proceed only if their item is on that list. I'm not sure how to
set this session variable since I leave my item list with a link instead of
an event. Is there an even that fires as I leave that page that would allow
me to capture the URL being used and set a session variable? Is there a
different approach I should be looking into? I appreciate anyone with the
patience to have read this far and look forward to your suggestions. Thanks!

Matt

[MattB]

Thanks for the ideas. I also forgot to mention these pages are in use and
I'd like to be able to make changes in the codebehind only.
I think the encryption of query strings is probably my best bet because I
could do all of that in the codebehind and not have to merge client's page
modifications to distribute this.

Do you know of a way to encrypt the entire query string (I have a good
encryption algorythm already)? I have three variables to pass, and it would
be nice to encrypt them all as one string that I could decrypt and parse out
afterwards.

Brad Quinn wrote:

Instead of constructing a URL you could use a TemplateColumn with a
LinkButton that has the CommandName attribute set to
"ViewItemDetails", for instance. Then wire up the ItemCommand event
for the DataGrid. You can then construct the URL in the event
handler, set a session variable, and do a Response.Redirect.

However this isn't really going to solve your problem.

If you want to be able to mail out a link to the item details page,
you have a problem in that there isn't an easy way to authenticate
the user.

Without authenticating the user the only thing I can think of is
possibly signing or encrypting the query string.
"MattB" wrote:

Not sure if this is a good approach or not, but I'd like to hear
some informed opinions. I've designed an ECommerce site that
interfaces with my company's POS system. I'm trying to make it as
flexible as possible because we resell it to our clients and they
all have different needs and preferences.
So the items for sale are displayed in a datagrid, and in the
ItemDataBound event, I construct a URL with query strings so that
when an item is selected, the next page knows what item was chosen.
The query string seemed like a good way to go because it works well
from the datagrid, and it makes the system more open, so that a
client can send out something like an "email special" with the URL
of an item with a special price that wouldn't show up in the normal
item list. This openness also creates a security risk, because a
hacker could look at the query strings being passed and start
guessing at other items they don't see in the item list and maybe
buy something the client didn't want to sell (like free stuff).
So I want to lock this down by having a list of items the client
needs
to generate that they would sell that don't appear in the regular
item list, and have any other non-regular items be denied.
I was thinking that I'd set a session variable as the user
leaves the item list page that says what item was selected. Then, on
the next page (item details) if the query string matches the session
variable, then they can proceed. If it doesn't, the list of allowed
hidden items is checked, and the user can proceed only if their item
is on that list. I'm not sure how to set this session variable since
I leave my item list with a link instead of an event. Is there an
even that fires as I leave that page that would allow me to capture
the URL being used and set a session variable? Is there a different
approach I should be looking into? I appreciate anyone with the
patience to have read this far and look forward to your suggestions.
Thanks!

Matt

[Chandra Sekhar]

This is really a good Idea and I have done this in the past. I replaced my
entire project's Redirects with my utility function GetEncodedURL, and the
Request("") with GetRequestObj("", Request.Querystring).

The change was much simple.

Sekhar.
"MattB" <so********@yahoo.com> wrote in message
news:2n************@uni-berlin.de...

Thanks for the ideas. I also forgot to mention these pages are in use and
I'd like to be able to make changes in the codebehind only.
I think the encryption of query strings is probably my best bet because I
could do all of that in the codebehind and not have to merge client's page
modifications to distribute this.

Do you know of a way to encrypt the entire query string (I have a good
encryption algorythm already)? I have three variables to pass, and it would be nice to encrypt them all as one string that I could decrypt and parse out afterwards.

Brad Quinn wrote:

Instead of constructing a URL you could use a TemplateColumn with a
LinkButton that has the CommandName attribute set to
"ViewItemDetails", for instance. Then wire up the ItemCommand event
for the DataGrid. You can then construct the URL in the event
handler, set a session variable, and do a Response.Redirect.

However this isn't really going to solve your problem.

If you want to be able to mail out a link to the item details page,
you have a problem in that there isn't an easy way to authenticate
the user.

Without authenticating the user the only thing I can think of is
possibly signing or encrypting the query string.
"MattB" wrote:

Not sure if this is a good approach or not, but I'd like to hear
some informed opinions. I've designed an ECommerce site that
interfaces with my company's POS system. I'm trying to make it as
flexible as possible because we resell it to our clients and they
all have different needs and preferences.
So the items for sale are displayed in a datagrid, and in the
ItemDataBound event, I construct a URL with query strings so that
when an item is selected, the next page knows what item was chosen.
The query string seemed like a good way to go because it works well
from the datagrid, and it makes the system more open, so that a
client can send out something like an "email special" with the URL
of an item with a special price that wouldn't show up in the normal
item list. This openness also creates a security risk, because a
hacker could look at the query strings being passed and start
guessing at other items they don't see in the item list and maybe
buy something the client didn't want to sell (like free stuff).
So I want to lock this down by having a list of items the client
needs
to generate that they would sell that don't appear in the regular
item list, and have any other non-regular items be denied.
I was thinking that I'd set a session variable as the user
leaves the item list page that says what item was selected. Then, on
the next page (item details) if the query string matches the session
variable, then they can proceed. If it doesn't, the list of allowed
hidden items is checked, and the user can proceed only if their item
is on that list. I'm not sure how to set this session variable since
I leave my item list with a link instead of an event. Is there an
even that fires as I leave that page that would allow me to capture
the URL being used and set a session variable? Is there a different
approach I should be looking into? I appreciate anyone with the
patience to have read this far and look forward to your suggestions.
Thanks!

Matt