I have a requirement to generate a one time use URL which should have the following features:
- As the URL query parameters may contain sensitive information, it should be encrypted (on top of
- Once used, the URL cannot be used again.
- URLs have automatic expiry after a certain amount of time.
- It shall be possible for an administrator to revoke a valid URL. If the user at a later point in time tries to use this URL, he should see an appropriate error message.
To do this, I can think of two high level approaches:
- Generate a random number as the query parameter of the URL. Store the random number and the corresponding parameters (i.e. the real query parameters, expiration, revocation status, used status) in a database. When the user uses the URL check all the required pre-conditions and mark it as used before providing the real query parameters.
- Embed the real query parameters and the expiration timestamp as the query parameter of URL. Encrypt the URL with an algorithm such as AES256. However, I would still need to store the URL in a database so as to provide the revocation feature.
Based on the above I am leaning towards option 1 as all the logic is in a single place and it looks more secure. Is there any industry best practice to deal with this type of problem?
If it matters, this will be a REST-based web service hosted on IIS.