CODEWITHSUNDEEP
laravellaravel-5
zerociudo
zerociudo

Reputation: 377

Laravel do not display id on form action to source

I was wondering are there ways in laravel to not display id to source with developer tools inspection I have this form

{!! Form::model($data, ['route' => ['data.edit',$data->id], 'method' => 'get']) !!}
      {{ Form::submit('Edit', array('class' => 'btn btn-info')) }}
{!! Form::close() !!}

With inspection user can see all forms like this ids and change one element id to another and on click he will edit the changed one? Are there any work around?

I would just check if that data entry belongs to the user in controller so at least user would not be able to delete or change entries that do not belong to him, but that is not the solution I want.

Upvotes: 2

Views: 198

Answers (1)

rypskar
rypskar

Reputation: 2092

Not if you set the id in the html. You could use session to store data, but you should always validate access on update. You should never trust the client.

Not having guessable id is also a reason to use uuid instead of auto increment for id, but even if you use uuid you need to check access on the server for all requests no matter if they are to get data or to update data

Upvotes: 5

Related Questions