Sign Up to our social questions and Answers Engine to ask questions, answer people’s questions, and connect with other people.
Login to our social questions & Answers Engine to ask questions answer people’s questions & connect with other people.
Lost your password? Please enter your email address. You will receive a link and will create a new password via email.
Please briefly explain why you feel this question should be reported.
Please briefly explain why you feel this answer should be reported.
Please briefly explain why you feel this user should be reported.
I need to pass a parameter through a Rails form and access it in the controller. I would use a hidden field tag, but I don’t want the user to be able to edit this data in the HTML and submit it. How can I secretly pass this parameter and access it on submit with parameter[:my_parameter]?
While a user can view hidden field data in almost any modern browser, they can’t directly modify it in the browser itself. They can, however, build up form-data and pass it using some other client of their choice (curl, fiddler, etc) – there isn’t really anything you can do about this. I suggest not relying on such a method for sensitive data.
A possible workaround would be to encrypt it in some form in advance, which can allow you to determine if it has been tampered with when posted. It can be tricky to do this right, and it’s not a common practice for passing parameters.
Perhaps if you can clarify what exactly you are trying to accomplish, someone may be able to suggest a suitable alternative.