RE: Encrypted URL

["scott wood" <swood () cambian com>]

We encrypted the query parameters in a case where we are sending out
an email alert containing a URL that the user can click on. I thought 
this would provide a little extra insurance against any manipulations 
to the query parameters that the user might try and make to view 
unauthorized pages or data. But we also force the user to authenticate 
and then we do role-based authorization checks. So as long as the authorization 
checking is being done properly for every possible manipulation, the 
encryption doesn't provide any extra protection. But just in case it isn't,
it seemed like a simple way to add some protection. 

scott
---
scott wood    swood at cambian dot com