I have a ASP.NET MVC 4 application.
In some webpages or views, I have information displayed in table. Column values are rendered as links.
Problems: 1. When I hover over the link, it's URL is visible at the bottom of browser. 2. When I click on link, I show information for the resource requested in URL. (www.someurl.com/Employee/67 gives me information of employee with id = 67). Now, this URL is displayed in browser. If you change URL to www.someurl.com/Employee/88, it shows information of employee with id = 88 though the logged in user is not supposed to see information for employee id 88
These are serious security breaches.
I am thinking of following as possible solutions:
URL masking at application level
Base64 encoding of URL to shorten and obfuscate it, so that users can't just throw values in the URL.
@Html.AntiForgeryToken() and ValidateAntiForgeryTokenValidation mechanism
Is there better and more secure approach other than above to solve this issue?
Regards,
Suraj
www.example.com/Employee/88
the server needs to verify the the current user may view that page.