Tips and Tricks

Encrypting Integer Values in ASP.NET MVC

If you want to encrypt integer values, then you're going to need to store the result as a string. If you're also going to roundtrip those values from the server to the browser, you'll need this code.

In an earlier column, I discussed a strategy for encrypting sensitive data to be embedded in your Web page in a hidden element (in another column, I suggested this was essential to avoid the over post hack). To support encrypting that data, I assumed the data in the Model object passed to your View would be stored in property of type String. However, as I suggested in that column, often the properties you want to encrypt are numeric. But what if you don't want to give up the data integrity you get by leaving those properties declared as numeric?

The solution is, instead of encrypting your data in your Controller's Action method as I did in that article, to encrypt your data in the View into an element with a different name than the one in your Model. For example, let's say you want to integrate the Id property of a Customer object, which is of type Integer. With this strategy, instead of using the HiddenFor element to embed the Id property into the page, you'll encrypt the Id property and place it in a hidden element. The key here is that this hidden element won't have its name attribute set to Id (if you set the element's name attribute to Id, then ASP.NET will just try to stuff your encrypted value in the numeric Id property on your Model object -- that's not going to end well).

Unfortunately, neither the HiddenFor or Hidden helper will let you override the name attribute in the HTML they generate, so you'll have to write the element yourself, like this:

@<input type = "hidden" name="encryptedId", id="Id" value="@EncryptText(Model.Id)"/>

To accept that data back when it's posted back to your Action method, you'll need to declare a second parameter to your method, using the overridden name. You'll decrypt that data in the second parameter back into its original value and use the result to update the integer value in the entity object:


Public Function UpdateCustomer(cust As Customer, encryptedId As String)
  cust.Id = Integer.Parse(AESEncryption.Decrypt(encryptedId))

Of course, as the number of hidden elements on the page increases, you'll need more of these "additional" parameters (it's not impossible to image a SalesOrderUpdate View with customer, order and multiple product ids, for example, all of which you might want to encrypt). It might be easier just to create a separate Model object with these Id properties declared as String and encrypt your data as you copy it from your entity object's properties to your Model object's properties.

About the Author

Peter Vogel is a system architect and principal in PH&V Information Services. PH&V provides full-stack consulting from UX design through object modeling to database design. Peter tweets about his VSM columns with the hashtag #vogelarticles. His blog posts on user experience design can be found at http://blog.learningtree.com/tag/ui/.

comments powered by Disqus

Featured

  • Visual Studio Code Dev Team Cleans Up

    The Visual Studio Code development team focused on some housekeeping in the October update, closing more than 4,000 issues on GitHub, where the cross-platform, open-source editor lives.

  • ML.NET Model Builder Update Boosts Image Classification

    Microsoft announced an update to the Model Builder component of its ML.NET machine learning framework, boosting image classification and adding "try your model" functionality for predictions with sample input.

  • How to Do Naive Bayes with Numeric Data Using C#

    Dr. James McCaffrey of Microsoft Research uses a full code sample and screenshots to demonstrate how to create a naive Bayes classification system when the predictor values are numeric, using the C# language without any special code libraries.

  • Vortex

    Open Source 'Infrastructure-as-Code' SDK Adds .NET Core Support for Working with Azure

    Pulumi, known for its "Infrastructure-as-Code" cloud development tooling, has added support for .NET Core, letting .NET-centric developers use C#, F# and VB.NET to create, deploy, and manage Azure infrastructure.

  • .NET Framework Not Forgotten: Repair Tool Updated

    Even though Microsoft's development focus has shifted to the open-source, cross-platform .NET Core initiative -- with the aging, traditional, Windows-only .NET Framework relegated primarily to fixes and maintenance such as quality and reliability improvements -- the latter is still getting some other attention, as exemplified in a repair tool update.

.NET Insight

Sign up for our newsletter.

Terms and Privacy Policy consent

I agree to this site's Privacy Policy.

Upcoming Events