#1 Encrypt urltokens/session indentifiers

[Kevin Bridges]

Build in the functionality to encrypt/decrypt url
tokens so that sessions can be maintained in an
encrypted fashion to illeminate session hijacking.

[Robert Everland III]

Logged In: YES
user_id=287869

How does FormURL2Attributes do it, why not steal it off of
that?

[Kevin Bridges]

Logged In: YES
user_id=306083

FormURL2Attributes doesn't really do anything more than
pass the cfid/token into the attributes scope. I've been
playing with this and have had a heck of a time with it.
Best I can determine is that the cfid/token get processed
somewhere before the Application.cfm ... which means that
simply decoding and then copying into the appropriate areas
doesn't work.

What I have been able to do to get it to work is set
session specific cookies that get deleted after the browser
is closed ... they reside in memory so they aren't
writeable by the end user. I had to modify the
act_Decode.cfm file to set these cookies each time the cfid
and cftoken comes out of the decode process.

I'm trying to find more info on how the backend of
cfid/token work so that I can do it strictly through urls.

Any thoughts/Suggestions anyone?

[Robert Everland III]

Logged In: YES
user_id=287869

Why don't you add everything to the attributes scope then?
I kind of like everything going to the attributes scope.
Maybe that is what the problem is. Maybe we should contact
the guy who made formurl so we can figure out what he did.

[Robert Everland III]

Logged In: YES
user_id=287869

This may be the answer, looks like the url friendly url
sets cfid and cftoken to a url variable

<cfswitch expression="#urlname#">

<cfcase value="cfid">

<cfparam name="url.cfid" default="\#urlvalue\#">

</cfcase>

<cfcase value="cftoken">

<cfparam name="url.cftoken" default="\#urlvalue\#">

</cfcase>

<cfdefaultcase>

<cfif urlvalue is "null">

    <cfset structinsert

(caller.attributes,"#urlname#","")>

<cfelse>

    <cfset structinsert

(caller.attributes,"#urlname#","#urlvalue#")>

</cfif>

<cfif attributes.createattributeslist>

    <cfset request.attributeslist = listappend

(request.attributeslist,urlname,"&")>

    <cfset request.attributeslist = listappend

(request.attributeslist,urlencodedformat(evaluate
("caller.attributes.#urlname#")),"=")>

</cfif>

</cfdefaultcase>