How does WebResources.axd or ScriptResources.axd actually work?

Question

Where can I learn how WebResources.axd or ScriptResources.axd actually works?

What is the string that is appended to the .axd? Does this string change, or is it constant? Is it page, session specific? Can these files be cached on a proxy?

How does it work internally? This is especially important after the ASP.NET vulnerability was discovered... as other people may want to not implement similar coding errors.

My understanding is that an encrypted key is used to direct how they operate.. (machine key) but I don't know much more.

Answer 1

You might want to check out the answers to this other question on StackOverflow: ScriptResource.axd d query string parameter.

It seems like these are just static javascript resources, where the query string is a hash identifying the DLL version they're housed in.

To see if the content changes at all for different pages & requests to the same iis application, you could use any number of tools -- e.g. Firebug's net panel in Firefox -- to view the http request & response bodies, then diff them with e.g. WinMerge to see if the content is changing.