加密URL的传参,可以提高整站的安全性,相关类可以使用:
using System; using System.Collections.Generic; using System.Collections.Specialized; using System.IO; using System.Linq; using System.Security.Cryptography; using System.Text; using System.Threading.Tasks; using System.Web; namespace MyCode.Security { public class ScrambleQueryStrings { #region Scrambling support //用于加密传参字符串 public byte[] ScrambleKey { set { byte[] key = value; if (null == key) { // Use existing key if non provided key = ScrambleKey; } HttpContext.Current.Session["ScrambleKey"] = key; } get { byte[] key = (byte[])HttpContext.Current.Session["ScrambleKey"]; if (null == key) { RC2CryptoServiceProvider rc2 = new RC2CryptoServiceProvider(); rc2.GenerateKey(); key = rc2.Key; HttpContext.Current.Session["ScrambleKey"] = key; } return key; } } public byte[] ScrambleIV { set { byte[] key = value; if (null == key) { key = ScrambleIV; } HttpContext.Current.Session["ScrambleIV"] = key; } get { byte[] key = (byte[])HttpContext.Current.Session["ScrambleIV"]; if (null == key) { RC2CryptoServiceProvider rc2 = new RC2CryptoServiceProvider(); rc2.GenerateIV(); key = rc2.IV; HttpContext.Current.Session["ScrambleIV"] = key; } return key; } } public string Scramble(string message) { UTF8Encoding textConverter = new UTF8Encoding(); RC2CryptoServiceProvider rc2CSP = new RC2CryptoServiceProvider(); //Convert the data to a byte array. byte[] toEncrypt = textConverter.GetBytes(message); //Get an encryptor. ICryptoTransform encryptor = rc2CSP.CreateEncryptor(ScrambleKey, ScrambleIV); //Encrypt the data. MemoryStream msEncrypt = new MemoryStream(); CryptoStream csEncrypt = new CryptoStream(msEncrypt, encryptor, CryptoStreamMode.Write); //Write all data to the crypto stream and flush it. // Encode length as first 4 bytes byte[] length = new byte[4]; length[0] = (byte)(message.Length & 0xFF); length[1] = (byte)((message.Length >> 8) & 0xFF); length[2] = (byte)((message.Length >> 16) & 0xFF); length[3] = (byte)((message.Length >> 24) & 0xFF); csEncrypt.Write(length, 0, 4); csEncrypt.Write(toEncrypt, 0, toEncrypt.Length); csEncrypt.FlushFinalBlock(); //Get encrypted array of bytes. byte[] encrypted = msEncrypt.ToArray(); // Convert to Base64 string string b64 = Convert.ToBase64String(encrypted); // Protect against URLEncode/Decode problem string b64mod = b64.Replace('+', '@'); // Return a URL encoded string return HttpUtility.UrlEncode(b64mod); } public string Descramble(string scrambledMessage) { UTF8Encoding textConverter = new UTF8Encoding(); RC2CryptoServiceProvider rc2CSP = new RC2CryptoServiceProvider(); // URL decode , replace and convert from Base64 string b64mod = HttpUtility.UrlDecode(scrambledMessage); // Replace '@' back to '+' (avoid URLDecode problem) string b64 = b64mod.Replace('@', '+'); // Base64 decode byte[] encrypted = Convert.FromBase64String(b64); //Get a decryptor that uses the same key and IV as the encryptor. ICryptoTransform decryptor = rc2CSP.CreateDecryptor(ScrambleKey, ScrambleIV); //Now decrypt the previously encrypted message using the decryptor // obtained in the above step. MemoryStream msDecrypt = new MemoryStream(encrypted); CryptoStream csDecrypt = new CryptoStream(msDecrypt, decryptor, CryptoStreamMode.Read); byte[] fromEncrypt = new byte[encrypted.Length - 4]; //Read the data out of the crypto stream. byte[] length = new byte[4]; csDecrypt.Read(length, 0, 4); csDecrypt.Read(fromEncrypt, 0, fromEncrypt.Length); int len = (int)length[0] | (length[1] << 8) | (length[2] << 16) | (length[3] << 24); //Convert the byte array back into a string. return textConverter.GetString(fromEncrypt).Substring(0, len); } public NameValueCollection DescrambleQueryString(string scrambledMessage) { // Decode the query string string queryString = Descramble(scrambledMessage); NameValueCollection result = new NameValueCollection(); char[] splitChar = new char[] { '&' }; char[] equalChar = new char[] { '=' }; // Split query string to components foreach (string s in queryString.Split(splitChar)) { // split each component to key and value string[] keyVal = s.Split(equalChar, 2); string key = keyVal[0]; string val = String.Empty; if (keyVal.Length > 1) val = keyVal[1]; // Add to the hashtable result.Add(key, val); } // return the resulting hashtable return result; } #endregion } }
使用也很简单:
string qs = "username=ahuinan&age=25&sex=男"; string scrambled_qs = Scramble(qs); Response.Write("加密后:" + scrambled_qs + "<br />"); NameValueCollection queryString = DescrambleQueryString(scrambled_qs); Response.Write("解密后值:<br />"); Response.Write(queryString["username"] + "<br />"); Response.Write(queryString["age"] + "<br />"); Response.Write(queryString["sex"]);