Sign Up to our social questions and Answers Engine to ask questions, answer people’s questions, and connect with other people.
Login to our social questions & Answers Engine to ask questions answer people’s questions & connect with other people.
Lost your password? Please enter your email address. You will receive a link and will create a new password via email.
Please briefly explain why you feel this question should be reported.
Please briefly explain why you feel this answer should be reported.
Please briefly explain why you feel this user should be reported.
I am very curious because I would like to be able to check this myself on my own site, as I am currently in the process of designing it. An example would be:
http://www.somesite.com/product.php?id=1356
When using Facebook, a user can change it and they get the user associated with this id. But in other sites, specifically Ecommerce sites, when I change it, it either fails or goes to the homepage.
There isn’t any way to see if the user changed it. This is part of secure coding. From the server’s perspective, you need to validate all of your inputs, and validate that the current user actually should have access to the resource they’re requesting.
See https://www.owasp.org/index.php/Top_10_2010-A4 for some additional details and examples.
Facebook may seem to allow this only for the example that you’ve given because the user profile ID that you’re attempting to access may be public to you. However, you won’t have access to all other user profiles – only user profiles that you have permission to access. If you tried to access my Facebook profile ID, you would also see your access be denied here.
Since this is tagged as e-commerce, you should also be aware of the PCI DSS if you aren’t already – where 6.5.4: “Insecure direct object references” applies specifically to this scenario.