I have an unsubscribe link, which needs to be passed a customer id, and a product id, producing a query string something like:
?cid=100&pid=2
I would like to ensure the customer is the one doing the unsubscribing, and that they are unsubscribing from the exact product. HMAC seems like a logical choice:
?cid=100&pid=2&hmac=<HMAC generated from secret key and cid=100&pid=2>
...and I can validate the HMAC to guarantee authenticity and integrity.
BUT I would also like to keep the customer id and product id confidential if the link is passed around in email, for example. I can't do that if the HMAC is based off of them. For example if I just passed the HMAC:
?hmac=<HMAC generated from secret key and cid=100&pid=2>
In this case I cannot not infer the customer id and product id in question (without brute forcing the hash).
Is there a standard way to return encrypted/hashed query parameters?
No, I can't use SSL/TLS.