加密URL的传参,可以提高整站的安全性,相关类可以使用:
using System;
using System.Collections.Generic;
using System.Collections.Specialized;
using System.IO;
using System.Linq;
using System.Security.Cryptography;
using System.Text;
using System.Threading.Tasks;
using System.Web;
namespace MyCode.Security
{
public class ScrambleQueryStrings
{
#region Scrambling support
//用于加密传参字符串
public byte[] ScrambleKey
{
set
{
byte[] key = value;
if (null == key)
{
// Use existing key if non provided
key = ScrambleKey;
}
HttpContext.Current.Session["ScrambleKey"] = key;
}
get
{
byte[] key = (byte[])HttpContext.Current.Session["ScrambleKey"];
if (null == key)
{
RC2CryptoServiceProvider rc2 = new RC2CryptoServiceProvider();
rc2.GenerateKey();
key = rc2.Key;
HttpContext.Current.Session["ScrambleKey"] = key;
}
return key;
}
}
public byte[] ScrambleIV
{
set
{
byte[] key = value;
if (null == key)
{
key = ScrambleIV;
}
HttpContext.Current.Session["ScrambleIV"] = key;
}
get
{
byte[] key = (byte[])HttpContext.Current.Session["ScrambleIV"];
if (null == key)
{
RC2CryptoServiceProvider rc2 = new RC2CryptoServiceProvider();
rc2.GenerateIV();
key = rc2.IV;
HttpContext.Current.Session["ScrambleIV"] = key;
}
return key;
}
}
public string Scramble(string message)
{
UTF8Encoding textConverter = new UTF8Encoding();
RC2CryptoServiceProvider rc2CSP = new RC2CryptoServiceProvider();
//Convert the data to a byte array.
byte[] toEncrypt = textConverter.GetBytes(message);
//Get an encryptor.
ICryptoTransform encryptor = rc2CSP.CreateEncryptor(ScrambleKey, ScrambleIV);
//Encrypt the data.
MemoryStream msEncrypt = new MemoryStream();
CryptoStream csEncrypt = new CryptoStream(msEncrypt, encryptor, CryptoStreamMode.Write);
//Write all data to the crypto stream and flush it.
// Encode length as first 4 bytes
byte[] length = new byte[4];
length[0] = (byte)(message.Length & 0xFF);
length[1] = (byte)((message.Length >> 8) & 0xFF);
length[2] = (byte)((message.Length >> 16) & 0xFF);
length[3] = (byte)((message.Length >> 24) & 0xFF);
csEncrypt.Write(length, 0, 4);
csEncrypt.Write(toEncrypt, 0, toEncrypt.Length);
csEncrypt.FlushFinalBlock();
//Get encrypted array of bytes.
byte[] encrypted = msEncrypt.ToArray();
// Convert to Base64 string
string b64 = Convert.ToBase64String(encrypted);
// Protect against URLEncode/Decode problem
string b64mod = b64.Replace('+', '@');
// Return a URL encoded string
return HttpUtility.UrlEncode(b64mod);
}
public string Descramble(string scrambledMessage)
{
UTF8Encoding textConverter = new UTF8Encoding();
RC2CryptoServiceProvider rc2CSP = new RC2CryptoServiceProvider();
// URL decode , replace and convert from Base64
string b64mod = HttpUtility.UrlDecode(scrambledMessage);
// Replace '@' back to '+' (avoid URLDecode problem)
string b64 = b64mod.Replace('@', '+');
// Base64 decode
byte[] encrypted = Convert.FromBase64String(b64);
//Get a decryptor that uses the same key and IV as the encryptor.
ICryptoTransform decryptor = rc2CSP.CreateDecryptor(ScrambleKey, ScrambleIV);
//Now decrypt the previously encrypted message using the decryptor
// obtained in the above step.
MemoryStream msDecrypt = new MemoryStream(encrypted);
CryptoStream csDecrypt = new CryptoStream(msDecrypt, decryptor, CryptoStreamMode.Read);
byte[] fromEncrypt = new byte[encrypted.Length - 4];
//Read the data out of the crypto stream.
byte[] length = new byte[4];
csDecrypt.Read(length, 0, 4);
csDecrypt.Read(fromEncrypt, 0, fromEncrypt.Length);
int len = (int)length[0] | (length[1] << 8) | (length[2] << 16) | (length[3] << 24);
//Convert the byte array back into a string.
return textConverter.GetString(fromEncrypt).Substring(0, len);
}
public NameValueCollection DescrambleQueryString(string scrambledMessage)
{
// Decode the query string
string queryString = Descramble(scrambledMessage);
NameValueCollection result = new NameValueCollection();
char[] splitChar = new char[] { '&' };
char[] equalChar = new char[] { '=' };
// Split query string to components
foreach (string s in queryString.Split(splitChar))
{
// split each component to key and value
string[] keyVal = s.Split(equalChar, 2);
string key = keyVal[0];
string val = String.Empty;
if (keyVal.Length > 1) val = keyVal[1];
// Add to the hashtable
result.Add(key, val);
}
// return the resulting hashtable
return result;
}
#endregion
}
}使用也很简单:
string qs = "username=ahuinan&age=25&sex=男";
string scrambled_qs = Scramble(qs);
Response.Write("加密后:" + scrambled_qs + "<br />");
NameValueCollection queryString = DescrambleQueryString(scrambled_qs);
Response.Write("解密后值:<br />");
Response.Write(queryString["username"] + "<br />");
Response.Write(queryString["age"] + "<br />");
Response.Write(queryString["sex"]);