CODEWITHSUNDEEP
phpcodeigniteriframeencryption
Taha
Taha

Reputation: 651

URL Encryption in php when passing sensitive parameters (joomla+codeigniter)

I'm using codeigniter inside joomla by using iframe. Some pages i need to get the user group if admin or user So i find a way to send values to iframe by using url with the following code:

<?php
//add user id
$user_id = JFactory::getUser()->id;
?>

<iframe <?php echo $this->wrapper->load; ?>
   id="blockrandom"
   name="iframe"
   src="<?php echo $this->escape($this->wrapper->url) . "?user=" . $user_id; ?>"

The problem is the type of the user will apear in url so is their any way to encrype the url and decrypt it in the other page?

Upvotes: 1

Views: 909

Answers (1)

Scott Arciszewski
Scott Arciszewski

Reputation: 34093

is their any way to encrype the url and decrypt it in the other page?

You're asking for some way to do this...

Encrypt a URL parameter

...when in reality, you want to do this:

Use a random lookup instead

The reasons why you want to avoid encryption are explained in depth in this blog post, but the main reasons are that encrypting URL parameters introduces the following concerns to your application:

  1. Chosen-ciphertext attacks
  2. Replay attacks
  3. Secure encryption would result URLs longer than most people are happy with (IV/nonce + HMAC tag)
  4. Side-channel cryptanalysis

Whereas the alternative is: You can simply add a UNIQUE TEXT field to your SQL table, populate it with base64_encode(random_bytes(15)), and call it a day.

All together now, shouting from the rooftops: Don't encrypt URL parameters, use a randomized lookup instead.

Upvotes: 1

Related Questions