We have a .NET (C#) web application which uses GUIDs to identify specific records in our MS SQL DB.
These GUIDs are generated and injected into the DB then used to create a response URL for the intended recipient to return to our application with.
We've checked and double checked and our outbound e-mail process is fine with all GUIDs being intact.
However, on a semi-regular basis, we're seeing invalid GUIDs in the URL's that are being requested by users.
Initially, we thought this intermittent error was a malicious "drive-by" type issue but investigating further, it seems that this is not the case. In fact, the issue is one of corruption.
We've managed to track and identify what is happening but we still don't know the how. As an example, here is one of our GUIDs and also the corrupted version of the same GUID we're seeing in the request for the page after the user receives and acts upon the email call to action.
Our GUID:
A715395B-F235-4C29-88AE-1AFCE949E11D
Corrupt GUID:
n7153952o-s23563-4p29-88nr-1nspr94954r11q
As you can see, the corrupt GUID has elements of the original GUID interspersed throughout but we can't see a reason or pattern for the corruption.
Our URL format is:
https://www.example.com/page/?guid1=GUID1&guid2=GUID2
When the corruption occurs, both GUIDs in the URL are corrupted and in fact, the order of the parameters are reversed so the URLs we see that contain the corrupted GUIDs look like:
https://www.example.com/page/?guid2=CORRUPTGUID2&guid1=CORRUPTGUID1
Any and all ideas as to how and why this would be happening would be most grateful. Half of the issue of solving something like this is understanding how and why it's happening but right now, we're stumped :-(
EDIT:
Additionally, there is a sort of pattern with the corruption as follows:
A -> n
B -> o
C -> p
D -> q
E -> r
F -> s
This represents of a shift of 45 characters but it does not explain the injected characters we also have.
Our GUID: A715395B-F235-4C29-88AE-1AFCE949E11D
Corrupt GUID: n7153952o-s23563-4p29-88nr-1nspr94954r11q
Our GUID: A715395B -F235 -4C29 -88AE -1AFCE949E11D
Converted GUID: A7153952B -F23563 -4C29 -88AE -1AFCE94954E11D
Injected chars: ^ ^^ ^^