Security with QueryString Values ​​in Asp.net MVC

Question

How do you properly ensure that the user does not interfere with querystring values ​​or action url values? For example, you might have the “Delete Comment” action on your CommentController that accepts the CommentID. The action URL may look like / Comments / Delete / 3 to delete the comment with identifier 3.

Now, obviously, you don’t want anyone to be able to delete comment 3. Usually, the owner of the comment or the administrator has permission to do so. I have seen that this security has been applied in many ways and would like to know how some of you do it.

You make several database calls to get a comment and check if the author of the comment matches the user who is causing the delete action?

Instead, you pass the CommentID and UserID to the stored procedure, which performs the deletion, and performs the deletion if the UserID and CommentID are equal to the values ​​passed in?

Is it better to encrypt query string values?

Answer 1

No.

This is a cardinal programming rule, especially on this day and at the age that you never trust any data coming from a user, browser, client, etc.

, , , , , . , , . .

, , . .

Answer 2

, , , HttpModule , StackOverflow.

" ", " " " " - ...

Answer 3

Vyrotek: . GET, POST, / GET - . , , , , , . , . .

Answer 4

, # 46 - , , [AcceptVerbs (HttpVerbs).Delete)]

Answer 5

Post- Accept Verbs, .

[AcceptVerbs(HttpVerbs.Post)]
public ActionResult Delete(int? id)
{
    //Delete
}

antiforgery, :

http://blog.codeville.net/2008/09/01/prevent-cross-site-request-forgery-csrf-using-aspnet-mvcs-antiforgerytoken-helper/

Answer 6

, querystring, , Base64 , "commentid = 4 & userid = 12345" "code = 1a2b23de12769"

" ", , .

Answer 7

.

, URL- .

, .

, .

, , .