Test code:

<cfset key=generateSecretKey("AES")>

<cfset link="https://forums.adobe.com/thread/2614394">

<cfset message=key & link>

<cfset encryptedMessage=encrypt(message,key)>

<cfset urlEncodedEncryptedMessage=urlEncodedFormat(encryptedMessage,"utf-8")>

<cfset urlDecodedEncryptedMessage=urlDecode(urlEncodedEncryptedMessage,"utf-8")>

<cfoutput>

    <p>

    key: #key#<br>

    </p>

    <p>

    message: #message#<br>

    </p>

    <p>

    encryptedMessage: #encryptedMessage#<br>

    </p>

    <p>

    urlEncodedEncryptedMessage: #urlEncodedEncryptedMessage#<br>

    </p>

    <p>

    urlDecodedEncryptedMessage: #urlDecodedEncryptedMessage#<br>

    </p>

    <p>

    decryptedMessage: #decrypt(urlDecodedEncryptedMessage,key)#

    </p>

    </cfoutput>

I think there is a flaw in the above algorithm. Namely the assumption that you can always pass encrypted characters, unchanged, through URL.

There is a second point. You're using AES anyway and CFMX_COMPAT is less secure than AES. So I don't understand why you use CFMX_COMPAT at all.

Your algorithm would be more efficient if it used the following steps instead:

1. Create AES secret key using Coldfusion inbuilt function (generateSecretKey("AES"))
2. Concatenate message as a string comprising secret key and URL
3. Encrypt the message with the AES secret key. (AES encryption)
4. Transform the message into a URL-encoded string using, for example, using urlEncodedEncryptedMessage=urlEncodedFormat(encryptedMessage,"utf-8")
5. Send this data as URL string to the requested page.
6. On the requested page, URL-decode then decrypt the data (AES decryption)

Hi,

can you share your code that does the encryption and the decryption?

Does the string you finally pass into the url contain "funny" characters that might be destroyed somehow (by wrong/repeated url encoding)?