Is the use of hidden fields in forms insecure?

Question

For example
Imagine I have the following form

  <%= form_for(@comment) do |f| %>

    <%= f.hidden_field :user_id%>
    <%= f.hidden_field :article_id%>

    <%= f.label :content %><br />
    <%= f.text_area :content %>

    <%= f.submit %>
  <% end %>

I got the :user_id and :article_id values with:

Comment.new(:user_id => current_user.id, :article_id => @article.id)

When I display the form in the browser it will look like this:

<form action="/comments" method="post">

  <input some_rails_tokens_here />

  <!-- THIS AREA HERE-->
  <input id="comment_user_id" name="comment[user_id]" type="hidden" value="1" />
  <input id="comment_article_id" name="comment[article_id]" type="hidden" value="1" />
  <!-- THIS AREA HERE-->

  <label for="comment_content">Content</label><br />
  <textarea id="comment_content" name="comment[content]"></textarea>

  <input type="submit" />
</form>

My question is, what if someone changes the post parameters and instead of being the value for :user_id => 1 it is changed to :user_id => 2. The same with the article.

I want to believe that is verified with the rails tokens, but I am not sure.

It was very easy to change the values. In "firebug" -> "edit" option, I just changed the "value" in HTML and voila! instead of being the user 1 I was posting as user 2. — David R, Mar 02 '11 at 06:53

score 7 · Accepted Answer · answered Mar 02 '11 at 05:50

A hidden field in a form is no more or less secure than any other data that come from user. That is, it should not be trivally trusted: It comes from the user and is open to manipulation and specialty injection.

When the data is sent back to the server, the server should validate that data and not assume that the operation is allowed/invalid just based on a particular user-modifiable context. Depending upon needs, approaches like hash checksums can be used to have a very high degree of confidence that the data was not tampered with (but again, this should be verified by the server each request!). Using "session state" mitigates the problem entirely by keeping the data out of user-manipulation land.

Happy coding.

Anand Shah · Answer 2 · 2011-03-02T05:45:52.583

3

If comments from un-registered users are allowed then why bother about the user_id at all, and if comments are only allowed from registered users then use sessions to track the user, instead of passing user_id in a form element.

And to answer your question if using hidden fields is insecure, without proper sanity check even the visible fields are insecure.

edited Mar 02 '11 at 05:45

answered Mar 02 '11 at 05:40

Anand Shah

14,575
16
72
110

score 1 · Answer 3 · answered Mar 02 '11 at 05:35

1

If the value of those fields is critical, then don't trust the user to return them unchanged. Otherwise, a hidden field is no less or no more secure than a regular visible field - if it's in the HTML, someone can change it.

answered Mar 02 '11 at 05:35

Marc B

356,200
43
426
500

score 1 · Answer 4 · answered Mar 02 '11 at 05:47

Data sent from the client to the server cannot be trusted without server-side checks (including HTML forms and browser cookies). The data could be maliciously modified or sent multiple times.

I have read stories about e-commerce sites that submitted the product price from an HTML form. A cheap user could edit the HTML form data they submit to the server to change the product price.

Is the use of hidden fields in forms insecure?

4 Answers4

Linked