CODEWITHSUNDEEP
asp.netasp.net-mvc
Leandro
Leandro

Reputation: 114

Prevent users change of hidden field value

I'm currently developing one project and I just discovered that the value of hidden fields can be edited. So that causes me a problem of security. Imagine that I have a form to edit personal information. Currently, the form has a hidden input that has the value of the primary key. So if someone change that value can update data from another people.

I already check here and on google and found a possible solution on https://mvcsecurity.codeplex.com/. But unfortunately, that's not available to the recent version of ASP.NET MVC. So I want to know if someone knows the properly way to prevent that.

Upvotes: 1

Views: 3935

Answers (2)

Shyju
Shyju

Reputation: 218722

The short answer is, Never trust data coming from client!

You should never trust data coming from a client browser. It can be altered by the end user. So don't simply trust the value. Always do needed validations on server side to make sure that the data / operation is valid.

In your specific case, When the form is submitted, you should check the value of the hidden field (the primary key value of the record being edited) is valid for the current user to be edited. Depending upon your systems user permissions/role system, you can do some if checks and determine whether the current user is authorized to do this operation with the value coming from client.

Upvotes: 6

RonC
RonC

Reputation: 33781

One solution is to encrypt the primary key before putting it in the hidden variable. That's the approach alot of site use, although often the encrypted var will be in the query string.

Upvotes: 0

Related Questions