Timeline for Protecting hidden form fields
Current License: CC BY-SA 3.0
5 events
when toggle format | what | by | license | comment | |
---|---|---|---|---|---|
Jun 17, 2014 at 9:22 | comment | added | Fleche | Just to clarify: Your suggestion is technically possible and not inherently wrong. For example, you could use a MAC (message authentication code) to prevent users from tampering with pre-defined parameters. However, this is five times as much complexity and only half as much security compared to a simple authorization check. So it's simply not worth it. | |
Jun 17, 2014 at 8:10 | comment | added | user3337410 | I didn't want to trust the user's input, hence the suggestion of the checksum but I guess that checksum then forms part of the user input. I didn't think about the time-lapse scenario Fleche mentioned so thanks for that. Auditing the DB update right before it occurs is probably the best option. | |
Jun 17, 2014 at 8:00 | vote | accept | user3337410 | ||
Jun 17, 2014 at 4:26 | comment | added | phyrfox | "Never trust the user's input" applies here. The server must validate that each attempt is actually allowed by the business logic. A browser can be easily manipulated even by the fairly uninitiated (consider the successful JavaScript like-jacking that goes on over Facebook). | |
Jun 16, 2014 at 23:51 | history | answered | Fleche | CC BY-SA 3.0 |