Mass emailing links to orders, private product, etc is something I do. Customer places an order to something and they receive an email for it. Standard thing right. I do not require the customers to logon to view that "order link" they received in there email. The combination of order#/date-placed is enough that brute forces attack will never yield anything useful to someone trying to figure out what has been ordered from us. This all breaks if the user copy/pastes that URL to somewhere & that URL ends up in the public. I needed a way to make that URL expire after X days.

Does anyone see a problem with adding any additional URL parm like

?secexp/AW*D(JP(@#R*$@#

that contains the experation date encrypted by the DotNetNuke.PortalSecurity.Encrypt(string,string) method?

I would then tweak the DotNetNuke.HttpModules.UrlRewriteModule to look for & decrypt the secexp parm & throw an HttpException if the date was not valid. Anyone see a fast way to hack that?