0

I have a hidden form field to delete an item in my razor web pages application

<input type="hidden" value="137" name="id">

user can easily alter the item value and delete other user's product, how do we secure this ?

Daniel A. White
  • 187,200
  • 47
  • 362
  • 445
ktm
  • 6,025
  • 24
  • 69
  • 95
  • It would help if you posted part of your code where you retrieve form values and update your database. – johna Oct 02 '12 at 08:45

1 Answers1

1

You should do server-side validation to ensure that that user has the appropriate authorization to edit/delete (or any other action) that entity.

As an example, in your Controller

[HttpPost]
public ActionResult Delete(int? id)
{
   if (CanUserDeleted(id))
   {
      Delete(id);
      // more magic
   }
   else
   {
      // Give the user an error
   }
}
Daniel A. White
  • 187,200
  • 47
  • 362
  • 445