i am calling API with Allow Anonymous Access

Question

[AllowAnonymous]
        [HttpGet]
        [Route("api/HelpVideo/{ID}")]
        [ResponseType(typeof(HttpResponseMessage))]
        public HttpResponseMessage GetHelpVideo(int ID)
        {
            try
            {
                HelpContent obj = db.HelpContents.Find(ID);
                string FileName = string.Empty;
                FileName = obj.FileName;
                if (!string.IsNullOrEmpty(FileName))
                {
                    FileProvider = new FileProvider(0, Global.FileLocationType.HelpDocument);
                    if (!FileProvider.Exists(FileName))
                    {
                        return this.Request.CreateResponse(HttpStatusCode.NotFound, new { Status = Global.Status.NotFound.ToString(), Message = Global.StatusMessage.NotFound });

                    }
                    string rootPath = HttpContext.Current.Server.MapPath(ConfigurationManager.AppSettings[AppSettingsKey] + "/Help/");
                    //var decodedFileName = Uri.UnescapeDataString(FileName);
                    var vidFile = File.OpenRead(Path.Combine(rootPath, FileName));

                    return new ProgressiveDownload(Request).ResultMessage(vidFile, "video/mp4");

                }
                else
                {

                    return this.Request.CreateResponse(HttpStatusCode.NotFound, new { Status = Global.Status.NotFound.ToString(), Message = Global.StatusMessage.NotFound });
                }
            }
            catch (Exception ex)
            {
                Global.InsertException(ex);
                return this.Request.CreateResponse(HttpStatusCode.InternalServerError, new { Status = Global.Status.Invalid.ToString(), Message = Global.StatusMessage.Invalid, MessageDetail = ex.Message + (ex.InnerException == null ? "" : ex.InnerException.Message) });

            }
        }
I need to encrypt  the ID parameter How to do that???

Answer 1

if you use guids instead of an int, they are harder to guess.

if the user is picking from a webpage where you display the link, then you would encrypt the id and an expiration date to a base64url string using any encryption you like.

then when you decrypt you can check if too old.