Hiding specifics in URL when going to the Detail Page(classic ASP)

[PA]

I'm sure there is a way to do this, but I forgot...

I'm using the DW "Go To Detail Page" behaviour to display a specific page,
based on what the user clicks from a list. This works fine. What I need to do
in to NOT have the resulting URL display what was selected. For example, this
is the URL after the user clicks the link:

[url]http://DOMAIN_NAME.com/DetailPage.asp?FIELD_NAME=VALUE[/url]

For security reasons, I need to have this work without displaying the
FIELD_NAME=VALUE

I'm not using a form, so I don't believe GET or POST are the issue.

Can anyone tell me how to do this?

Thanks!

[darrel]

> I'm using the DW "Go To Detail Page" behaviour to display a specific
page,

> based on what the user clicks from a list. This works fine. What I need to

do

> in to NOT have the resulting URL display what was selected. For example,

this

> is the URL after the user clicks the link:
>
> [url]http://DOMAIN_NAME.com/DetailPage.asp?FIELD_NAME=VALUE[/url]
>
> For security reasons, I need to have this work without displaying the
> FIELD_NAME=VALUE

Security via obscurity? ;o)

The solution is to not pass the value via a querystring. Can you use a
server variable, or roundtrip to a database or something?

-Darrel

[PA]

Thanks, I guess that would work.

Storing the querystring value to a cookie would also work, right?

Which server variable were you referring to?

Thanks for the reply!

Paul

[darrel]

> Storing the querystring value to a cookie would also work, right?

Provided the end-user is enabling and accepting cookies.

> Which server variable were you referring to?

I dunno...what kind of server-side coding are you using?

-Darrel

[PA]

The server side is ASP / vbScript

Thanks,
Paul

[Julian Roberts]

You may need to rethink your architecture. Querystrings shouldn't be an
issue. Perhaps you could expand on why you need to not show the querystring.

--
Jules
[url]http://www.charon.co.uk/charoncart[/url]
Charon Cart 3
Shopping Cart Extension for Dreamweaver MX/MX 2004

[PA]

Jules,

Thanks for the reply. The reason I don't want the variables shown in the
address bar is because I can't have people changing the variables (id=3445 to
id=3667 for example) and being able to access records that aren't theirs.

As I mentioned, I'm not using forms at all on the main page, the user simply
clicks a link that represents a "company ID" and displays only that company's
records. If I were using forms, I would then just use a POST when going to the
detail page.

Any suggestions?

Thank you

[darrel]

> Thanks for the reply. The reason I don't want the variables shown in the

> address bar is because I can't have people changing the variables (id=3445

to

> id=3667 for example) and being able to access records that aren't theirs.

That's security through obscurity = not really secure at all.

You should be using user profiles of some sort...only items that that user
has permission to see can be seen. This will make the querystring issue moot
at that pont.

That said,

-Darrel

[PA]

Darrel,

I agree, and will do something like this. Thanks

In the short term while I develop this, I need to at least "band-aid" this and
somehow hide the values in the address bar. Is there a way to do this? If so,
please let me know. Otherwise, thanks for all the help, I do appreciate it.

[Julian Roberts]

Are you doing any filtering on the results page? If so, you could apply a
similar filter on the details page.

--
Jules
[url]http://www.charon.co.uk/charoncart[/url]
Charon Cart 3
Shopping Cart Extension for Dreamweaver MX/MX 2004