Tips and Tricks

Encrypting Integer Values in ASP.NET MVC

If you want to encrypt integer values, then you're going to need to store the result as a string. If you're also going to roundtrip those values from the server to the browser, you'll need this code.

In an earlier column, I discussed a strategy for encrypting sensitive data to be embedded in your Web page in a hidden element (in another column, I suggested this was essential to avoid the over post hack). To support encrypting that data, I assumed the data in the Model object passed to your View would be stored in property of type String. However, as I suggested in that column, often the properties you want to encrypt are numeric. But what if you don't want to give up the data integrity you get by leaving those properties declared as numeric?

The solution is, instead of encrypting your data in your Controller's Action method as I did in that article, to encrypt your data in the View into an element with a different name than the one in your Model. For example, let's say you want to integrate the Id property of a Customer object, which is of type Integer. With this strategy, instead of using the HiddenFor element to embed the Id property into the page, you'll encrypt the Id property and place it in a hidden element. The key here is that this hidden element won't have its name attribute set to Id (if you set the element's name attribute to Id, then ASP.NET will just try to stuff your encrypted value in the numeric Id property on your Model object -- that's not going to end well).

Unfortunately, neither the HiddenFor or Hidden helper will let you override the name attribute in the HTML they generate, so you'll have to write the element yourself, like this:

@<input type = "hidden" name="encryptedId", id="Id" value="@EncryptText(Model.Id)"/>

To accept that data back when it's posted back to your Action method, you'll need to declare a second parameter to your method, using the overridden name. You'll decrypt that data in the second parameter back into its original value and use the result to update the integer value in the entity object:

Public Function UpdateCustomer(cust As Customer, encryptedId As String)
  cust.Id = Integer.Parse(AESEncryption.Decrypt(encryptedId))

Of course, as the number of hidden elements on the page increases, you'll need more of these "additional" parameters (it's not impossible to image a SalesOrderUpdate View with customer, order and multiple product ids, for example, all of which you might want to encrypt). It might be easier just to create a separate Model object with these Id properties declared as String and encrypt your data as you copy it from your entity object's properties to your Model object's properties.

About the Author

Peter Vogel is a system architect and principal in PH&V Information Services. PH&V provides full-stack consulting from UX design through object modeling to database design. Peter tweets about his VSM columns with the hashtag #vogelarticles. His blog posts on user experience design can be found at

comments powered by Disqus


  • AI for GitHub Collaboration? Maybe Not So Much

    No doubt GitHub Copilot has been a boon for developers, but AI might not be the best tool for collaboration, according to developers weighing in on a recent social media post from the GitHub team.

  • Visual Studio 2022 Getting VS Code 'Command Palette' Equivalent

    As any Visual Studio Code user knows, the editor's command palette is a powerful tool for getting things done quickly, without having to navigate through menus and dialogs. Now, we learn how an equivalent is coming for Microsoft's flagship Visual Studio IDE, invoked by the same familiar Ctrl+Shift+P keyboard shortcut.

  • .NET 9 Preview 3: 'I've Been Waiting 9 Years for This API!'

    Microsoft's third preview of .NET 9 sees a lot of minor tweaks and fixes with no earth-shaking new functionality, but little things can be important to individual developers.

  • Data Anomaly Detection Using a Neural Autoencoder with C#

    Dr. James McCaffrey of Microsoft Research tackles the process of examining a set of source data to find data items that are different in some way from the majority of the source items.

  • What's New for Python, Java in Visual Studio Code

    Microsoft announced March 2024 updates to its Python and Java extensions for Visual Studio Code, the open source-based, cross-platform code editor that has repeatedly been named the No. 1 tool in major development surveys.

Subscribe on YouTube