In my app (and website) a user logs in with their email to perform actions like making a comment on the website under their name. Obviously it is important that malicious people cannot pretend to be this user and send comments on their behalf.
I read that any state changing actions should never be performed by a GET request. What is to stop someone from creating a POST request using the authenticated user's email address? Is it possible for someone to tell my website to perform a POST request and spoof the inputs?
In my database I am thinking of storing some kind of token to validate a user (lets call the token authentication_token). For example, every time a user logs in, authentication_token is updated in the database for the user and sent back to be stored in a SESSION on the website or in the app. Now everytime a request is made (for example making a comment), the stored SESSION is checked in the database to make sure it matches before proceeding to make the comment.
- User presses "Submit comment" button on website or in app
- POST request is sent with inputs user_email, comment, and authentication_token
- SELECT authentication_token FROM Users_Table WHERE email=user_email
- Proceed to step 5 only if the retrieved authentication_token matches authentication_token that was sent in the POST request.
- Create the comment.
Is this a secure way to validate an action? Is transfer of authentication_token safe over https? Thank you for any help.