Checking that the query string has not changed

Question

I have the following code to check that a query string has not changed:

protected void Page_Load(object sender, EventArgs e)
        {
            if (!this.IsPostBack)
            {
                Label_Error.Visible = false;
                string query_string = Request.QueryString["GUID"].ToString();
                Session["GUID"] = query_string;
            }

            else
            {
                string GUID = "";

                try
                {
                    GUID = Session["GUID"].ToString();
                }
                catch (Exception)
                {
                    Session.Abandon();
                    Response.Redirect("CheckOutErrorPage.htm");
                    return;
                }

                if (GUID.Equals(Request.QueryString["GUID"].ToString()) == false)
                {
                    Session.Abandon();
                    Response.Redirect("CheckOutErrorPage.htm");
                }
            }
        }

Now, I have this code in a button-click event handler to check that the value of the query string has not changed (again):

protected void ImageButton_LogIn_Click(object sender, ImageClickEventArgs e)
        {
            Validation val = new Validation();

            string GUID = "";
            string query_string = "";

            try
            {
                GUID = Session["GUID"].ToString();
                query_string = Request.QueryString["GUID"].ToString();
            }
            catch (Exception)
            {
                Session.Abandon();
                Response.Redirect("CheckOutErrorPage.htm");
                return;
            }

            if (val.EmptyString(GUID) == true || val.checkTransactionGUIDExists(GUID) == false || GUID.Equals(query_string) == false)
            {
                Session.Abandon();
                Response.Redirect("CheckOutErrorPage.htm");
            }

Now, the problems are two:

1) if I change the query string in the URL and click on the button, the user is not redirected to the error page.

2) if I change the query string in the URL and hit enter in the address bar, the user is not redirected to the error page.

What I want basically is that, when the user is redirected to the web page, it saves the query string into a session. If the user changes the value of the query string in the address bar, and either pressed enter in the address bar or presses my button, he is redirected to the error page.

However, my code is failing. Can anyone help please? Thanks :)

Answer 1

How about this instead?

protected void Page_Load(object sender, EventArgs e)
{
    // Always get the query string no matter how the user go to this page
    string query_string = Request.QueryString["GUID"].ToString();

    // Only store the query string in Session if there is nothing in Session for it
    if(null == Session["GUID"])
    {
        Session["GUID"] = query_string;
    }

    if (!this.IsPostBack)
    {
        Label_Error.Visible = false;
    }

    // Always check to see if the query string value matches what is in Session
    string GUID = "";
    try
    {
        GUID = Session["GUID"].ToString();
    }
    catch (Exception)
    {
        Session.Abandon();
        Response.Redirect("CheckOutErrorPage.htm");
        return;
    }

    if (GUID.Equals(Request.QueryString["GUID"].ToString()) == false)
    {
        Session.Abandon();
        Response.Redirect("CheckOutErrorPage.htm");
    }

This should solve your problem of the Session value being overwritten when a query string is put into the address bar and enter is pressed by the user.

Answer 2

I think you problem is that Response.Redirect needs the false at the final of the sentence like Response.Redirect("CheckOutErrorPage.htm", false); becouse that you have it inside the try cath the error will be throw.

I hope that help you.