Home/ Questions/Q 188099
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-11T15:56:38+00:00

Any good strategies, code snippets etc for preventing URL manipulation? For example I have

  • 0

Any good strategies, code snippets etc for preventing URL manipulation?

For example I have this url, http://localhost/profile/edit/5 the id could easily be changed to anything and thus people could edit profiles they are not supposed too.

Here are a few ideas I thought of but they all have there drawbacks:

  1. Change my system to use GUID primary keys – makes it almost impossible to guess the keys – but people can still take the GUID from one part of app and use it in another url later.

  2. Use TempData to store the keys – prevents urls being sent around\used later.

  3. Perform checks in the controller before displaying page – means you have to do ‘adminy’ code everywhere to check operations.

Whats the best thing to do? One of these or something else?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Number 3 is the correct thing to do. Server-Side Security Validation is always what you need, because this is the mechanism that you completely control and can rely on.

    Number 1 is Security by Obscurity, and if someone accidentally posts his URL somewhere (like people often do with Session-IDs when they copy/paste links), your ‘Security’ is broken.

    Number 2 seems like a weak security – if you go through the hassle, better implement proper security. That also allows people to bookmark the page.

    • 0