sql server reporting services: Hiding parameter passed through query string -- sql server reporting services

You're in the

sql server reporting services

group:

Hiding parameter passed through query string

Mark
12/27/2005 10:35:24 AM

sql server reporting services:

I'm using Reporting Servicves for SQL Server 2000 and I've embedded a
ReportViewer control in an ASP.NET page. The reports I link to all require a
sensitive parameter value and I have been passing that through using the
query string. Unfortunately, the entire URL of the report--including the
parameter in the query string--is visible in the source for the page, and I
don't want the user to see this for security purposes.

Is there a way to hide this? I'm open to any and all suggestions.

Thanks,

Re: Hiding parameter passed through query string

Oleg Yevteyev
12/27/2005 10:49:43 AM

Search the group on encryption - use System.Security.Cryptography package
I just repeat myself from a previous posting:

"Parameter's encryption is a key to solve your problem.
The simplest ( but not the only) way is:
1.create your own parameters collection pages (forms).
2. encrypt user input using a permanent or temporary encryption key.
3. Reference encryption assembly in your report designer.
4. use a decryption routine in your custom code akin
"=Code.Library.Decrypt(Parameters!account_id);" by retrieving an encryption
key used in step 2.
By using this approach even a simplest parameter will be totally un
guessable, because even a single digit will be encrypted to something like
"bHZiajB4TGpBdU1"
"

[quoted text, click to view]

Re: Hiding parameter passed through query string

Bruce L-C [MVP]
12/27/2005 12:51:11 PM

For RS 2000 you can use web services. There is really no way using URL
integration to hide it from the source. You can hide it from the page being
displayed but if they go View, Source they will see it.

In VS 2005 there are two new controls that work with RS 2005. They use web
services under the covers, not URL integration. You do have to have RS 2005.
Note that you can upgrade to RS 2005 while leaving the database at 2000
(that is what I have done). You do need a SQL Server 2005 license for this
however.

My suggestion is if security is important then you use the new controls.

One other option, put the parameters in a database table and then pass the
primary key to the table and have a dataset extracting the parameters.

This does make things more complicated but it is a version independent
solution (if you can convince management to upgrade to RS 2005). Note what I
said about upgrading. Sometimes it is easier to get permission to upgrade
reporting services than it is to upgrade a SQL Server database.

--
Bruce Loehle-Conger
MVP SQL Server Reporting Services

[quoted text, click to view]

Re: Hiding parameter passed through query string

Bruce L-C [MVP]
12/27/2005 1:09:30 PM

Good point. I forgot about doing that.

--
Bruce Loehle-Conger
MVP SQL Server Reporting Services

[quoted text, click to view]

Got something to say? Click here to post a reply to this thread.

Don't see what you're looking for? Try a search.

View other messages in the sql server reporting services group.

home · blog · groups

Questions? Comments? Contact the dn