Take the 2-minute tour ×
SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. It's 100% free, no registration required.

I'm seeing odd behavior while visiting a SharePoint 2010 website.

The parameters that I request are encoded by what seems to be a Base64 encoding algorithm. However, it is definitely not JUST Base64. I'll demonstrate.

http://www.domain.com/asd/en/Pages/webpage.aspx?k=asd

becomes

http://www.domain.com/asd/en/Pages/webpage.aspx?eqs=gwBNxFGLCmc=

Another Example:

http://www.domain.com/asd/en/Pages/webpage.aspx?k=a

becomes

http://www.domain.com/asd/en/Pages/webpage.aspx?eqs=vmZXlPYEAxQ=

Those entered parameters always generate the same output. The generated URL can be moved from one browser to another and still represent the same data ( aka, moving moving the new URL to another browser will still contain the information in the originally submitted URL)

It appears to be a rotating XOR / base64 encoding algorithm ( maybe ) ... below are a few more examples that demonstrate this.

aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa

becomes

+QboZB5u1gKc9Vgk0qmOr+W5MJr7V9YAj8ZBdFnzq5C4YoeoMZoh1IaoZIXBWv5fghPmDTBQzDDAtvgqgKJHu3+k4yT9p
UNnX3oT8qnSaDU=

next, I removed 1 a from the URL parameter.

aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa

becomes

+QboZB5u1gKc9Vgk0qmOr+W5MJr7V9YAj8ZBdFnzq5C4YoeoMZoh1IaoZIXBWv5fghPmDTBQzDDAtvgqgKJHu3+k4yT9p
UNnCLx2ZNpn6g4=

Lastly, I changed an A in the middle of the string to a B

aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaabaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa

becomes

+QboZB5u1gKc9Vgk0qmOr+W5MJr7V9YAj8ZBdFnzq5Drwcmg4YDW7GA++ZJnLbCB+P4oA2IAz5J+YwZ+aPWBbXCBPXJBZ
IxZs5PntWYp7t4=

As you can see, the encoded string, after the B is significantly different than what was shown above.

I must also mention, that this is generated during the initial request. Meaning, I request the webpage, it responds with a 302 containing the newly generated, encoded URL. aka, this is not being done client side.

My question, what method is generating this in SharePoint, if any? ( maybe a plugin ) Also, how are they encoding the parameters in the URL. What is the algorithm?

share|improve this question

migrated from stackoverflow.com Apr 24 '11 at 15:12

This question came from our site for professional and enthusiast programmers.

2  
Something is re-writing the URL and it is most likely either the code-behind on the specific page, or an HTTP module. Is the site running Project Server or Team Foundation? What kind of site template is it? Do you have access to the site with SharePoint Designer? I would suggest opening the page and looking at the referenced assembly type to see what assembly is implementing the page. –  Chris Beckett Apr 24 '11 at 17:17

2 Answers 2

It sounds like a proxy is running between you and your SharePoint server, and rewriting the URL query string. Could it be ForeFront UAG ?

share|improve this answer

This definitely does not look like a SharePoint mechanism. I guess you have something else between SharePoint and your users:

  • Proxy
  • Authenticate Proxy
  • Additional module on your SharePoint server
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.