URL cloaking with ASP.NET (C#)

Introduction

Nowadays content management systems (CMS) are a commodity. These systems enable regular users to create and maintain websites with little or no technical skills at all. Usually CMS are built with databases and the pages in sites created in the CMS are accessed through a URL looking like this:

http://www.somecompany.com/Templates/page1213___.aspx

or

http://www.somecompany.com/content.aspx?pageID=1213 etc.

For an experienced user, this really doesn't matter, but from a usability perspective - it's illegal! If you're a regular user looking for information, URLs like the ones below probably would make more sense to you:

http://www.somecompany.com/product

or

http://www.somecompany.com/support

This is where URL cloaking comes in handy.

Background

To try this trick out, create an empty solution in VS.NET, add a C# ASP.NET Web application (Call it "Cloaking"). Create and add 404.aspx, content1.aspx, content2.aspx and content3.aspx to your solution. Make sure to fill them up with some content so that you can distinguish them from each other.

Your solution explorer should look something like this:

Setting a custom 404 errorpage

In order to pull this trick off, you need to configure IIS to use the customized 404 error page (in this example, 404.aspx). To do that, go to the IIS administration console, select the correct website (in this example the website is called "Cloaking"). Right click it and choose "Properties" then select the "Custom Errors" tab.

Find the 404 entry in the list of errors and click "Edit properties". Select URL in the "Message Type" dropdown and type the full path to the 404.aspx page in the URL textbox, in this example "/Cloaking/404.aspx".

It should look something like this:

Switch back to VS.NET, open the Global.asax file and view the code. Scroll down to the Application_BeginRequest method and paste the following:

// The requested URL

string strURL = Request.RawUrl.ToLower(); 
    
// If the page didnt exist, the IIS tries to send the visitor to 404.aspx, 

//this is where we intercept.

if(strURL.IndexOf("404.aspx") > 0) 
{ 
    // Scan the path for the keywords and rewrite the path to the preferred content

    if (strURL.IndexOf("products") > 0) Context.RewritePath("content1.aspx");
    if (strURL.IndexOf("sales") > 0) Context.RewritePath("content2.aspx");
    if (strURL.IndexOf("support") > 0) Context.RewritePath("content3.aspx");
}

..and there you have it!

If you browse http://localhost/Cloaking/Products, the browser will display the contents of content1.aspx and maintain the nice URL in the address field.

The code uses the strURL.IndexOf() method to detect keywords, this is kind of crude and is just meant to illustrate the technique.

Good use of URL cloaking

In order to make good use of this trick, you'd want to implement it in a CMS system. To illustrate the possible usage, in your CMS you probably have a table containing the pages of the website. Extend the pages table with a column called "path" and search that column in the application_beginrequest method to find the appropriate page to redirect to.

Does it sound interesting? Drop a comment and maybe I'll post a simple CMS that implements URL cloaking.

History

• 2005-04-10: Created