How To Provent URL variable tampering?

[scorniglia]

Hi,
I am passing a variable to a form through a url that contains an id variable and CF session variables. This works fine but anyone can just the change the variable in the url and see someone elses data. So if the original url is:

main.cfm?id=36

someone can just change it to main.cfm?id=20 in the address bar, hit the enter key and see the data for the person with id 20. What is the best way to prevent this or obscure the url so it is not evident what needs to be changed?

I though about adding the id, cfid, and cftoken to one long number and then checking for this number on each subsequent page, but am not sure what would be the best way to institute this. Any ideas or thoughts about this are
appreciated. What do other people do in this scenario?

--
Regards,
Roy F.

 

[SidianConsulting]

You can use either session or client variables to store this id, instead of passing it through the URL. ColdFusion can then reference the session or client variable based on the cfid and cftoken, which can be passed in cookies, the URL, or form fields (via the GET method, which just makes them URL variables anyway).

-Tek

 

[scorniglia]

Thanks Tek,

I guess a session variable is probably the way to go. So what I would do is assign the id to a session variable at login and then on subsequent pages compare the session id to the id passed in the url to be sure they're the same. Makes sense. thanks again.

Regards,
Roy F.

 

[neofactor]

For added security...

I always make a users ID a random 8 character number.
That way they have a tougher time trying to hit it.

When I have info only a specific user can edit.. I assign a session variable to the ID and their Security level on login.

I can than allow certain level users to edit anyone account or limit the choices if they are changing their own. Certainly preventing access to others.

David McIntosh

http://www.neofactor.com

 

[SidianConsulting]

If you use session or client variables to store identifcation numbers, it doesn't matter whether you use a UUID or integer for the unique identifier, as the client side will never even get ahold of that data or pass it in any way. If you must pass identifiers through a URL or FORM, encrypting the variables would be the best way, second to the safest of not passing them at all.

-Tek

 

[neofactor]

I agree...

Send it as a post whenever possible or encrypt the data.

David McIntosh

http://www.neofactor.com

 

[webmigit]

faq232-1926

A not only shameless plug, but helpful too.. The above faq gives you a short tutorial on CFLOCK and sessions.. a way to save you a lot of time and maintain data, and script integrity..

I recommend using session variables or at least cookies, encrypting the data in them as Teknology suggested..

If you're building the site for any kind of security, sessions are the way to go... or if you're building it for developers.. trust me, developers hate the sites they depend on to be insecure...

Tony