Question

When I look back my codes that written earlier time, I found something terribly bad.
Whenever I want to delete a record in the database, I did like this :

$.post("deleteAction.do",{recordId:10});

I cannot prevent a malicious user visit my database operation url directly :

deleteAction.do?recordId=10 

What’s the solution for this kind of problem ?

Answer 1

It really depends on your data and the checks you do on the server side. For example. If you check if the user is allowed to perform the delete action on that record, it isn’t such a big problem. If you don’t, it means the user can delete the data of other users too. My suggestion would be:

1. Add extra checks on the server side to prevent users from deleting other data then their own.
2. In stead of using integers you can also use something like guids, or another identifier that is hard to alter (read: unpredictable). This prevents “smartheads” from trying to break down your application.