Tips and Tricks
Encrypting Integer Values in ASP.NET MVC
If you want to encrypt integer values, then you're going to need to store the result as a string. If you're also going to roundtrip those values from the server to the browser, you'll need this code.
In an earlier column, I discussed a strategy for encrypting sensitive data to be embedded in your Web page in a hidden element (in another column, I suggested this was essential to avoid the over post hack). To support encrypting that data, I assumed the data in the Model object passed to your View would be stored in property of type String. However, as I suggested in that column, often the properties you want to encrypt are numeric. But what if you don't want to give up the data integrity you get by leaving those properties declared as numeric?
The solution is, instead of encrypting your data in your Controller's Action method as I did in that article, to encrypt your data in the View into an element with a different name than the one in your Model. For example, let's say you want to integrate the Id property of a Customer object, which is of type Integer. With this strategy, instead of using the HiddenFor element to embed the Id property into the page, you'll encrypt the Id property and place it in a hidden element. The key here is that this hidden element won't have its name attribute set to Id (if you set the element's name attribute to Id, then ASP.NET will just try to stuff your encrypted value in the numeric Id property on your Model object -- that's not going to end well).
Unfortunately, neither the HiddenFor or Hidden helper will let you override the name attribute in the HTML they generate, so you'll have to write the element yourself, like this:
@<input type = "hidden" name="encryptedId", id="Id" value="@EncryptText(Model.Id)"/>
To accept that data back when it's posted back to your Action method, you'll need to declare a second parameter to your method, using the overridden name. You'll decrypt that data in the second parameter back into its original value and use the result to update the integer value in the entity object:
Public Function UpdateCustomer(cust As Customer, encryptedId As String)
cust.Id = Integer.Parse(AESEncryption.Decrypt(encryptedId))
Of course, as the number of hidden elements on the page increases, you'll need more of these "additional" parameters (it's not impossible to image a SalesOrderUpdate View with customer, order and multiple product ids, for example, all of which you might want to encrypt). It might be easier just to create a separate Model object with these Id properties declared as String and encrypt your data as you copy it from your entity object's properties to your Model object's properties.
About the Author
Peter Vogel is a system architect and principal in PH&V Information Services. PH&V provides full-stack consulting from UX design through object modeling to database design. Peter tweets about his VSM columns with the hashtag #vogelarticles. His blog posts on user experience design can be found at http://blog.learningtree.com/tag/ui/.