隐藏字段的完整性：Asp.NET mvc
我们一直使用asp.net mvc进行开发。有时，我们需要在表单上放置一些隐藏字段，这些字段由 modelbinder 推送到模型中（如预期）。如今，用户可以使用 firebug 或其他实用程序轻松调整表单。隐藏字段的目的主要是按原样向服务器提供一些信息，并且它们不应该被更改。
例如，在我的编辑员工表单中，我可以将 EmployeeID 放入隐藏字段中，但如果用户更改隐藏字段中的员工 ID，错误的员工将在数据库中更新。在这种情况下，我们如何保持隐藏字段的完整性。
We have been using asp.net mvc for development. Sometimes, we need to put some hidden fields on form that are shoved in the model by modelbinder (as expected). Nowadays, users can easily temper the form using firebug or other utilities. The purpose of hidden field is mostly to provide some information back to server on as is basis and they are not meant to be changed.
For example in my edit employee form I can put EmployeeID in hidden field but if user changes the employeeID in hidden field, wrong employee will be updated in the database. in this scenario how can we keep the integrity of hidden fields.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
您需要加强安全性以确保进行修改的人有权这样做。我通常还会将 id 放在 URL 中，而不是隐藏字段中，依靠安全性来确保人们不会修改他们不应该修改的内容。如果他们在手动更改 ID 时确实有权修改该项目，那么这应该不是问题。重要的是确保人们无法手动更改 ID 并访问他们不应该访问的内容。强制执行服务器端权限可以解决此问题。您可以结合使用 Roles 和 AuthorizeAttribute 轻松地完成此操作。
You need to enforce security to ensure that the person doing the modification has permission to do so. I'd also put the id in the URL typically rather than a hidden field, relying on the security to ensure that people don't modify things that they shouldn't be able to. If they do have permission to modify the item when changing the id manually, it shouldn't be a problem. The important thing is to make sure that a person can't change the id manually and get access to something they shouldn't. Enforcing server side permissions solves this problem. You can easily do this using Roles in conjunction with the AuthorizeAttribute.
这是您网站中的一个主要安全漏洞。在您进行 Web 开发时所做的每一件事中，无论某人的代码多么聪明，或者您认为只要用户不做某事就可以没事，请记住一条黄金法则：永远不要隐式信任从客户端。
为了修改网站中的任何内容，用户必须登录。（对吗？）因此，在用户尝试将表单发布到网站时（尤其是可以修改数据的表单），仔细检查提交表单的用户是否有权对指定的数据执行所请求的操作。
理想情况下，每个不完全公开且不安全的操作都应该进行服务器端权限检查。永远、永远不要相信客户发给你的东西。
This is a major security hole in your website. In everything you do with web development, no matter how clever someone's code might be or how much you think you'll be ok as long as users don't do something, remember one golden rule: Never implicitly trust data received from the client.
In order to modify anything in your website, the user must be logged in. (Right?) So in any attempt a user makes to post a form to the website (especially one which can modify data), double-check that the user submitting the form has permission perform the action being requested on the data being specified.
Ideally, every action which isn't completely public and unsecured should have a server-side permissions check. Never, ever trust what the client sends you.
一种潜在的替代方案是将静态的一次性信息存储在服务器上的 TempData 中，而不是将其传递到可能被篡改的客户端。请记住，默认情况下 TempData 使用 Session 并且有其自身的限制 - 但它可能是一个选项。
One potential alternative would be to store that static, single-use information in TempData on the server and not pass it to the client where it could be tampered with. Keep in mind that by default TempData uses Session and has limitations of its own - but it could be an option.