Skip to main content

Timeline for Protecting hidden form fields

Current License: CC BY-SA 3.0

5 events
when toggle format what by license comment
Jun 17, 2014 at 9:22 comment added Fleche Just to clarify: Your suggestion is technically possible and not inherently wrong. For example, you could use a MAC (message authentication code) to prevent users from tampering with pre-defined parameters. However, this is five times as much complexity and only half as much security compared to a simple authorization check. So it's simply not worth it.
Jun 17, 2014 at 8:10 comment added user3337410 I didn't want to trust the user's input, hence the suggestion of the checksum but I guess that checksum then forms part of the user input. I didn't think about the time-lapse scenario Fleche mentioned so thanks for that. Auditing the DB update right before it occurs is probably the best option.
Jun 17, 2014 at 8:00 vote accept user3337410
Jun 17, 2014 at 4:26 comment added phyrfox "Never trust the user's input" applies here. The server must validate that each attempt is actually allowed by the business logic. A browser can be easily manipulated even by the fairly uninitiated (consider the successful JavaScript like-jacking that goes on over Facebook).
Jun 16, 2014 at 23:51 history answered Fleche CC BY-SA 3.0