I'm seeing odd behavior while visiting a SharePoint 2010 website.

The parameters that I request are encoded by what seems to be a Base64 encoding algorithm. However, it is definitely not JUST Base64. I'll demonstrate.




Another Example:




Those entered parameters always generate the same output. The generated URL can be moved from one browser to another and still represent the same data ( aka, moving moving the new URL to another browser will still contain the information in the originally submitted URL)

It appears to be a rotating XOR / base64 encoding algorithm ( maybe ) ... below are a few more examples that demonstrate this.




next, I removed 1 a from the URL parameter.




Lastly, I changed an A in the middle of the string to a B




As you can see, the encoded string, after the B is significantly different than what was shown above.

I must also mention, that this is generated during the initial request. Meaning, I request the webpage, it responds with a 302 containing the newly generated, encoded URL. aka, this is not being done client side.

My question, what method is generating this in SharePoint, if any? ( maybe a plugin ) Also, how are they encoding the parameters in the URL. What is the algorithm?

  • 2
    Something is re-writing the URL and it is most likely either the code-behind on the specific page, or an HTTP module. Is the site running Project Server or Team Foundation? What kind of site template is it? Do you have access to the site with SharePoint Designer? I would suggest opening the page and looking at the referenced assembly type to see what assembly is implementing the page. – Chris Beckett Apr 24 '11 at 17:17

It sounds like a proxy is running between you and your SharePoint server, and rewriting the URL query string. Could it be ForeFront UAG ?

| improve this answer | |

This definitely does not look like a SharePoint mechanism. I guess you have something else between SharePoint and your users:

  • Proxy
  • Authenticate Proxy
  • Additional module on your SharePoint server
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy