At the moment non/semi sensitive information is sent from one page to another via GET on our web application. Such as user ID or page number requested etc. Sometimes slightly more sensitive information is passed such as account type, user privileges etc.
[EDIT: I may have worded this wrong, I'm not passing sessionID or actual user privileges, just simple NON-sensitive data - I just don't want the user to see the words easily, does not matter if a more technical user can read it as they cannot do any damage and cause security concerns. read the chat with @delnan]
We currently use base64_encode() and base64_decode() just to de-humanise the information so the end user is not concerned.
Is it good practice or common place for a URL GET to be encrypted rather than simply PHP base64_encoded?
Perhaps using something like, this:
$encrypted = base64_encode(mcrypt_encrypt(MCRYPT_RIJNDAEL_256, md5($key), $string, MCRYPT_MODE_CBC, md5(md5($key)))); $decrypted = rtrim(mcrypt_decrypt(MCRYPT_RIJNDAEL_256, md5($key), base64_decode($encrypted), MCRYPT_MODE_CBC, md5(md5($key))), "\0");
Is this too much or too power hungry for something as common as the URL GET.