I'm designing some 2-page master/detail relations, and caught the note in Wrox's "Professional ASP.NET 2.0" on page 732 about security issues with QueryString.

I'm hoping to find some alternatives to using QueryString to pass information from page to page. I can think of:
> hidden fields, populated by OnClick prior to postback
> Cross-Page postbacks
Any others to consider? Also, any links that discuss the pro's and con's of these options?

Any suggestions on this would be appreciated.

Thanks!

You can also use session variables

Thanks for input. I'll add that to the list!

No problem.

So here's my quick take on pro's and con's.
QueryString = + conventional web coding
              - security exposures

CrossPage Postbacks (not really different than other alt's)

HiddenField + more secure (not "hanging out" visible)
              - not completely hidden (may be found in page text)
              - extra coding steps

SessionState + more secure (can't be seen on page at all)
              - resource use (but won't hiddenfields also use memory?)
                     (app needs sessionstate anyway...)
              + "global variable" type programming ( + for my skill set..)

App will probably run under HTTPS anyway, but ya nevah 'no...

Anything else come to mind?

Thanks!