Question

How much some one can modify a javascript to intercept the post parameters to hack or missplay

 function search(tableEvent)
        {
            clearResults()
            document.getElementById('loading').style.display = 'block';
            var params = 'formAction=SearchInterviewNomineesCent';
            params += '&reqNo=${param.reqNo}';
            params += '&reqSeq=${param.reqSeq}';
            params += '&reqClass=${param.reqClass}';
            params += '&reqYear=${param.reqYear}';
            params += '&relatedReqYear=${param.relatedReqYear}';
            params += '&relatedReqSeq=${param.relatedReqSeq}';
            params += '&relatedReqNo=${param.relatedReqNo}';
            params += '&relatedReqClass=${param.relatedReqClass}';
            params += '&tableEvent=' + tableEvent;
            createXmlHttpObject();
            sendRequestPost(http_request,'Controller',false,params);

            prepareUpdateTableContents();

        }

am using JAVA MVC and am curious can some one edit javascript for the above code to get a different search result by modify search criteria like reqNo and reqSeq

UPDATE:
i mean here an organization with local network , so the attack would be from some employee who has access to system

Answer 1

First of all anyone can edit any javascript you see in the browser. They can manipulate values and what it sends to the server. Furthermore they could simply write their own code to post to your url. It isn’t in the client side that you will make your system secure but on the server side.