Encryption of the query string in the URL

[Ritesh]

Hi

We found out about this weird problem that happens on the encrypted string that we send across as a query string on the url. The page shows the erro
"The page has encountered an error...." and when I go to the the view source it displays this message
<!-- Error Information
Error: A potentially dangerous Request.QueryString value was detected from the client (aub=&quot;&lt;!-- Error Informati...&quot
StackTrace: at System.Web.HttpRequest.ValidateString(String s, String valueName, String collectionName
at System.Web.HttpRequest.ValidateNameValueCollection(NameValueCollection nvc, String collectionName
at System.Web.HttpRequest.get_QueryString(
at System.Web.UI.Page.GetCollectionBasedOnMethod(
at System.Web.UI.Page.DeterminePostBackMode(
at System.Web.UI.Page.ProcessRequestMain(
at System.Web.UI.Page.ProcessRequest(
at System.Web.UI.Page.ProcessRequest(HttpContext context
at System.Web.CallHandlerExecutionStep.System.Web.HttpApplication+IExecutionStep.Execute(
at System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean&amp; completedSynchronously
--

Now I know that this is encountered when the string has some invalid characters, but we checked the string that is generated due to the encryption
The real string is BA\cjg1760
and the encrypted string i
yqtlVNykIrXno79onQdGxg=

We are also encoding the string by using the Server.UrlEncode statement. the string is
yqtlVNykIrXno79onQdGxg%3d%3d
after the encoding

I have checked for invalid or dangerous (script type characters) in the string but everything looks good. Now this error occurs only on thius one user out of almost 2000 users

Another weird thing is , if we do another Server.UrlEncode on the string and then decode it while retreiving, it works fine..

If any of you have encountered similar problems, please let me know what workaround you used. Right now only thing i can think of is use th
<pages validateRequest="false"> statement in the Web.confi

thanks in advance
Ritesh

 

[David Coe]

It sounds like you are encrypting the query string, then encoding it, then attempting to decrypt it. You will also need a step in there that decodes it before trying to decrypt it.

 

[Ritesh Desai]

Hi ,

Thnaks for the reply. The first decode happens automatically when I try
to retrieve it. SO there is no decode statement.

More I see it, I think it to be a bug in the Microsoft cross site
scripting program. It seems to script out valid strings.

You know it works, if i change the case of any letter(s) within the
windows id. It seems to me that the encrypted and encoded string screws
something up in the cross site scripting program.

THanks