Posting sensitive data via href's

Question

Hey all
Is it possible to send sensitive data which you don't want the user to see
via a hyperlink to a servlet? As far as I know hyperlinks can only call the doGet method so the passed parameters are viewable to the user. Are there any best practices when wanting to communicate safely between JSP's and servlets using hyperlinks?
Thanks!

Answer 1

Get the query string and encrypt it using something like this:
public static String encrypt(String msg){
String passPhrase = "passphrase";
try {
KeySpec keySpec = new DESKeySpec(passPhrase.getBytes());
SecretKey key = SecretKeyFactory.getInstance("DES").generateSecret(keySpec);
Cipher ecipher = Cipher.getInstance(key.getAlgorithm());
ecipher.init(Cipher.ENCRYPT_MODE, key);
//Encode the string into bytes using utf-8
byte[] utf8 = msg.getBytes("UTF8");
//Encrypt
byte[] enc = ecipher.doFinal(utf8);
//Encode bytes to base64 to get a string
return new sun.misc.BASE64Encoder().encode(enc);
} catch (InvalidKeyException e) {
e.printStackTrace();
} catch (InvalidKeySpecException e) {
e.printStackTrace();
} catch (NoSuchAlgorithmException e) {
e.printStackTrace();
} catch (NoSuchPaddingException e) {
e.printStackTrace();
} catch (IllegalStateException e) {
e.printStackTrace();
} catch (IllegalBlockSizeException e) {
e.printStackTrace();
} catch (BadPaddingException e) {
e.printStackTrace();
} catch (UnsupportedEncodingException e) {
e.printStackTrace();
return null;
}and attach back the encrypted query string as:
http:\\mycompany.com?data=<the_encrypted_query_string_returned_by_above_method>
Now, when you want to retrieve the contents of the query string, send the contents of the "data" to the method below:
public static String decrypt(String msg){
String passPhrase = "passphrase";
KeySpec keySpec;
try {
keySpec = new DESKeySpec(passPhrase.getBytes());
SecretKey key = SecretKeyFactory.getInstance("DES").generateSecret(keySpec);
Cipher decipher = Cipher.getInstance(key.getAlgorithm());
decipher.init(Cipher.DECRYPT_MODE, key);
// Decode base64 to get bytes
byte[] dec = new sun.misc.BASE64Decoder().decodeBuffer(msg);
//Decrypt
byte[] utf8 = decipher.doFinal(dec);
//Decode using utf-8
return new String(utf8, "UTF8");
} catch (InvalidKeyException e) {
e.printStackTrace();
} catch (InvalidKeySpecException e) {
e.printStackTrace();
} catch (NoSuchAlgorithmException e) {
e.printStackTrace();
} catch (NoSuchPaddingException e) {
e.printStackTrace();
} catch (IOException e) {
e.printStackTrace();
} catch (IllegalStateException e) {
e.printStackTrace();
} catch (IllegalBlockSizeException e) {
e.printStackTrace();
} catch (BadPaddingException e) {
e.printStackTrace();
return null;You will now get the original query string, you should parse it to get the individual parameters, since you must already know the parameter names, the parsing part should be easy.