Question

In order to use some AJAX calls, we use often some input type=”hidden”. But these values can be easily changed. So, is it a builtin rails feature than permit to send date to AJAX, withouth being usable by user, or than can’t be changed by user ?

In my current rails apps, i’m using filters for discard all malicious actions on my controllers. I am not building a public API, so i don’t really need more powerful checks.

But for examples, i have an apotomo widget displaying some data, using some input hidden. But if you change it, you can access to another data set. In my case, it’s not really an issue, cause all these users have the right to access these data sets anyway.

But is it some manner to give datas to ajax call, in a secure way ? Or the only security, is about rights management ?

Answer 1

All input that comes from the user is insecure as you do not have control over it! Users even do not need a webbrowser but can use some other program (like curl or wget) to send manipulated data.

As you state, using a whitelist (not a blacklist as you can never be sure of all bad, but of all good!) is a good way to start.

To make sure the hidden fields have not been changed you can use some kind of checksum that is calculated on server side using a fixed secret. This secret must never be exposed to your visitors!

 hash = md5(field_1 + field_2 + field_3 + my_secret)

When these four hidden fields (field_1..3, hash) arrive in your form you can recalculate the hash and compare it with the params[:hash] in order to be sure the field_1 to field_3 have not been changed.