I am trying to develop a website where I grab data using javascript and send it to PHP using ajax post. However, while researching, I found that the POST request can be modified using third-parties software such as Postman (I believe). However, if I use an HTTPS connection, will this be prevented?
If this isn't secure, however, what are solutions to transfer javascript data to PHP securely?
Thank you
This is not a javascript, POST or HTTPS problem, it affects all data received by a web server. Although realizing that someone might edit a URL might be easier to realize that cookies and other HTTP request headers cannot be trusted.
You cannot prevent the data from being manipulated, an attacker could use an intercepting proxy such as burp or fiddler, the browser developer tools. Or even manually construct the request using curl or while fiddly I sometimes do something like this:
echo -ne 'POST /uri HTTP/1.1\r\nHost: hostname.com\r\nContent-Type: application/json\r\n\r\n{"key":"value"}\r\n\r\n' | \
openssl s_client -connect hostname.com:443
This is why web application security often focuses quite heavily on input validation. Such as the OWASP proactive controls: https://owasp.org/www-project-proactive-controls/v3/en/c5-validate-inputs
Validating the data server side can be tricky, but as you cannot trust the data you receive there aren't many other options. In addition to validating the data you'll also need to ensure you handle it in context safe ways, like using parameterized database queries and encoding html characters in page output.
