Tips and Tricks

Encrypting Integer Values in ASP.NET MVC

If you want to encrypt integer values, then you're going to need to store the result as a string. If you're also going to roundtrip those values from the server to the browser, you'll need this code.

In an earlier column, I discussed a strategy for encrypting sensitive data to be embedded in your Web page in a hidden element (in another column, I suggested this was essential to avoid the over post hack). To support encrypting that data, I assumed the data in the Model object passed to your View would be stored in property of type String. However, as I suggested in that column, often the properties you want to encrypt are numeric. But what if you don't want to give up the data integrity you get by leaving those properties declared as numeric?

The solution is, instead of encrypting your data in your Controller's Action method as I did in that article, to encrypt your data in the View into an element with a different name than the one in your Model. For example, let's say you want to integrate the Id property of a Customer object, which is of type Integer. With this strategy, instead of using the HiddenFor element to embed the Id property into the page, you'll encrypt the Id property and place it in a hidden element. The key here is that this hidden element won't have its name attribute set to Id (if you set the element's name attribute to Id, then ASP.NET will just try to stuff your encrypted value in the numeric Id property on your Model object -- that's not going to end well).

Unfortunately, neither the HiddenFor or Hidden helper will let you override the name attribute in the HTML they generate, so you'll have to write the element yourself, like this:

@<input type = "hidden" name="encryptedId", id="Id" value="@EncryptText(Model.Id)"/>

To accept that data back when it's posted back to your Action method, you'll need to declare a second parameter to your method, using the overridden name. You'll decrypt that data in the second parameter back into its original value and use the result to update the integer value in the entity object:


Public Function UpdateCustomer(cust As Customer, encryptedId As String)
  cust.Id = Integer.Parse(AESEncryption.Decrypt(encryptedId))

Of course, as the number of hidden elements on the page increases, you'll need more of these "additional" parameters (it's not impossible to image a SalesOrderUpdate View with customer, order and multiple product ids, for example, all of which you might want to encrypt). It might be easier just to create a separate Model object with these Id properties declared as String and encrypt your data as you copy it from your entity object's properties to your Model object's properties.

About the Author

Peter Vogel is a system architect and principal in PH&V Information Services. PH&V provides full-stack consulting from UX design through object modeling to database design. Peter tweets about his VSM columns with the hashtag #vogelarticles. His blog posts on user experience design can be found at http://blog.learningtree.com/tag/ui/.

comments powered by Disqus

Featured

  • C# Slides in Usage Ranking of Programming Languages

    "The fact that C# lost three places in the ranking of language communities during the last three years is mostly explained by its slower growth compared to C/C++ and PHP."

  • Telerik UI for Blazor Updated

    Progress announced an update to its Telerik UI for Blazor components, targeting Microsoft's open source Blazor framework that lets C# coders create web apps without having to rely upon JavaScript.

  • Infragistics Unveils UI Components for Blazor

    Infragistics, specializing in third-party UI/UX controls and tools, unveiled a new offering targeting Blazor, Microsoft's red-hot open source framework that allows for C#-based web development instead of traditional mainstay JavaScript.

  • AWS Open Sources Tool for Porting .NET Framework Apps to .NET Core

    Leading cloud computing platform Amazon Web Services open sourced the it announced in July for helping users port old .NET Framework applications to the new .NET Core framework.

  • Uno Platform Ports Windows Calculator to Linux

    Uno Platform has ported the famed Windows Calculator, open sourced last year, to Linux as part of a continuing "proof point" effort to demonstrate the reach of what it describes as the sole UI offering available to target Windows, WebAssembly, iOS, macOS, Android and Linux with single-codebase applications coded in C# and XAML.

Upcoming Events