Relying on hidden inputs and query strings
Suppose I have a request handler that takes an argument: key
And let the request be:
When the handler receives a GET, the corresponding data is fetched from the db based on that key, submitted to the form, and displayed. In this process, the key value is put into hidden input.
When it receives a POST, it has a key argument from the query string, as well as a key from the hidden input, which is the same, assuming the user hasn't tampered with them.
I would like to know if I should use hidden input or query string argument when the data in the form will be saved to the db. The problem is that the query string can be changed by the user prior to publishing, just as hidden input can also be changed since the source is open to the user.
a source to share
Well, whatever data you send to the client is subject to change (this might not be trivial, but the possibility exists nonetheless).
There are many options; Querystrings, hidden fields, cookies, to name a few. Each of them suffers from this very drawback - the likelihood that a malicious user can change the data in these objects.
Strong encryption is best. Whether it is data in a hidden field or a cookie, it can be easily encrypted. Then, when the request is received, it can be compared to the value that existed before the earlier response, and it can be decrypted with a reasonable belief that the data has not been tampered with. For a good example, you should learn how ASP.NET Viewstate works .
So, to answer your question, you shouldn't rely on any of the statefulness methods without additional security implementation. As the saying goes, Security through obscurity is not security.
a source to share