I’m currently developing a web application (using laravel) where I have a form that edit a resource. Something like this:
<!-- URL: /editResource/3 -->
<form action="/editResource/3" method="POST">
<!-- Input fields -->
</form>
When I send the form the web application will update the resource 3.
But how I can prevent something like using developer tools to modify /editResource/3 to /editResource/4 and edit the wrong resource?
I’m not asking how to prevent some user editing other user resources; this can be accomplished by a simple validation, but I’m asking how to prevent user modifying this kind of data, since HTTP is stateless.
Thank you
EDIT: The question was misleading, I want to clarify that what I’m trying to find is a way to keep some information between requests, without user modifying it. I’m sending the information: 3 to the client so in the next request, the server knows that the user is editing the resource 3, but I want to do this without the risk generated by user changing this data.
3
I’d store the data server side in a session object or user profile record and then send the unmodified data each time.
You can’t. If the data is on the user’s end, the user is in control of it, not you. Trying to change this is an arms race you don’t want to get into.
Instead, worry about what you have control of: the server. Validate data instead of blindly trusting it. HTTP may be stateless, but your app on the server-side doesn’t have to be!
10