How to hide the parameters passed into servlet or make it read only

Question

Hi,
I am calling a servlet to downlaod files, using
<a href="../servlet/DownloadFile?directory=<%=attachmentPath%>&fileName=<%=fileName%>">But this will display all the paramters passed , of course as I am using hyper link. However I can not use
<form> to call the servlet because otherwise I got nested form anyway.
So the users would be able to change the directory and file names to download files I do not like them to download. Somebody would suggest hardcode the directory and filename, but these two parameters are dynamic, so I have to pass them into the servlet everytime I call it.
Any advice to disable the users to change or even view the two parameters on the address bar?
Thanks
</a>

Answer 1

Here some code snippets to give you an idea of what I do.
Let's say you want to retrieve a file from your server, and you need to pass the full directory path info in your URL. You might have code as follows:
String fileName = "/server/SomeUltraSecretHiddenDirectory/ImportantSecretFile.doc";
Click <a href="/fileservlet?fileName=<%=URLEncoder.encode(fileName)%>">HERE</a> to download file.Using the above code, ANYONE can retrieve this file if they know the URL. Also, they could try to change the URL paths to find other files. In other words, it's NOT SECURE.
Now, try it this way (all exception handling is left out):
private static final byte[] salt = { (byte)0xd4, (byte)0xa3, (byte)0xff, (byte)0x9e,
(byte)0x12, (byte)0xc7, (byte)0xd0, (byte)0x84 };     
String fileName = "/server/SomeUltraSecretHiddenDirectory/ImportantSecretFile.doc";
base64Encoder = new BASE64Encoder();
base64Decoder = new BASE64Decoder();
// get key object
SecretKey key = null;               
PBEKeySpec keySpec = new PBEKeySpec("somesecretkeystring");
SecretKeyFactory kf = SecretKeyFactory.getInstance("PBEWithMD5AndDES");
key = kf.generateSecret(keySpec);     
// get parameter spec
PBEParameterSpec paramSpec = new PBEParameterSpec(salt, 1000);
// create cipher
Cipher c = Cipher.getInstance("PBEWithMD5AndDES");
c.init(Cipher.ENCRYPT_MODE, key, paramSpec);     
// take string and get encrypt it (base-64 encode it to get rid of non-printable characters
byte[] aResult = c.doFinal(fileName.getBytes("UTF-8"));
String strResult = base64Encoder.encodeBuffer(aResult);
// print the link
Click <a href="/fileservlet?fileName=<%=URLEncoder.encode(strResult)%>">HERE</a> to download file.
// on the server side, do the following to decrypt the link
String encryptedFileName = request.getParameter("fileName");
// create decryption cipher (i'm skipping a lot of the init code this time - see above for code example)
Cipher c = Cipher.getInstance("PBEWithMD5AndDES");
c.init(Cipher.DECRYPT_MODE, key, paramSpec);
// decrypt string
byte[] aResult = c.doFinal(base64Decoder.decodeBuffer(encryptedFileName));
String strResult = new String(aResult, "UTF-8");Now you have the decrypted String. Your link will be unreadable and unbreakable. 100% safe as long as your key password is safe. I hope that gives you an idea of what you can do with cryptography!
A few notes:
- Most of the above code is in separate methods that can be easily reused (especially encrypt() and decrypt())
- All exception handling has been left out
- The above code was patched together from memory, so don't expect it to work as is (that's my disclaimer :)
- You'll need the JCE libraries to use this functionality.
- For REALLY sensitive data (such as passwords), make sure you use one-way encryption (hashes) if you don't ever need to decrypt it again.
Michael