Security risk passing id in URL

9/21/2010 7:42 am | #1 nickj

The Wizard sets up the relationship between results and updae by passing the the record ID in the URL, which would allow anyone who has access to the results page the ability to see any record by typeing in different IDs into the URL. I can change the update button into a form and POST the ID, then code the recorset on updatepage to use a post rather than a GET>.

Is this correct? Is there a better way?

Nick

9/21/2010 8:41 am | #2 Jason ByrnesWebAssist

this really only becomes an issue if only certain users are supposed to view certian items in the results.

how are you determining who should be able to view which records, is it only one record that each user should be able to view? or are you using user groups? a user can view a collection of the records?

9/22/2010 9:24 am | #3 codamedia

I'm with Jason on this one. GET is suppose to be used to display data, so pages can be bookmarked and even indexed at search engines (we won't go there rigth now - LOL).

If you are trying to "hide" certain data or proectect page - you should be protecting it in another way.

Email me with all replies to this thread

Title:

Public Message: (viewable by anyone reading this thread)
(do not cut and paste code into this field unless necessary, attach copies of your pages so they can be opened in Dreamweaver for debugging)

Quote message in reply?

Private Message: (viewable only by you, the person you are replying to, and WebAssist employees)
(only put truly private information in this area such as ftp details and phone numbers. Keep as much of your post public as possible)

These attachments are private (viewable only by you, the person you are replying to, and WebAssist employees)

Manage Attachments

Technical Support Forums

Free, outstanding support from WebAssist and your colleagues

Security risk passing id in URL

9/21/2010 7:42 am | #1 nickj