I have two scenarios and want to know if each is secure or which risk there are.
If the User has the edit Link (edit/[md5hash]) he can edit a post. The editkey (the hash) is in an form hidden field to tell the Controller Action which post is going to be edited.
The user could edit the value of that field, but would need other keys, to change other posts, wouldn't he?
When the user creates a post. A cookie with the name "post[id]" and the md5-edit-hash as value is set.
When a post is requested the controller checks if the edit-hash in that cookie (if it exists) is the same as in the post data.
It is unsafe if many people would share the browser and the cookies are not reseted, isn't it? Are there any other issues or any solutions to make it safer and better?
I'm using Laravel 3 - a PHP Framwork Yes, I'm avoiding authentication for special reasons ;)
I could use any other hash method like SHA, if this would be a problem
The hash is generated from a timestamp + salt + postid + salt + authorname