Query string parameters and tempering

Question

So let's that I have two dependent objects whose id's i pass in the query string, and let's say I am not going through parent to get the child but rather I read child directly via dao and I can save it also, without going through parent. What should one do on the client side, or should I even check it to see if id of the parent in the query string matches id of the parent associated with a child fetched via dao?

/parent/123/child/15

Answer 1

If there are security considerations (authorization for editing a particular child), then you most definately want to check the parent id. If someone owns parent/23 and its childern, but they don't own parent/24, you wouldn't want them modifying the URL and changing parent 24's childern.

If that is not the case, you probably don't have any reason to even pass the parent/parentID