How to prevent changing state of controls on the client most easily?

Question

What I'm trying to achieve is basically to prevent client-side change of the state of my server controls.

For example, let's say that I have a business web applications, that shows some data in read-only fashion to the regular users, but allow the admin to edit the data. In such case I use regular ASP.NET server controls, but disable them for the regular user (enabled=false). The problem that I have is that any advanced user could change the disabled control on the client using short javascript code and check the supposedly disabled and unchecked checkbox.

From my standpoint this is serious security problem and I'm more than surprised that I cannot find no one asking questions about that.

Perhaps I'm missing something, but please let me know what is the easiest way to prevent this client-side change. I thought that when the control is disabled before rendering the page, the following postback would not touch this control at all, no matter how you change it on the client. Did I get terribly wrong?

Answer 1

I would do a double check on the server-side.

There is no guarantee that a request will always come from your (unmodified) page. Anyone can craft an HTTP request that mimics whatever your postback is doing.

Answer 2

If you use a Placeholder control and hide it, nothing will be rendered to the screen.

Answer 3

Hi, my 2 cents on your problem. I would rather use a formview /detailsview if both the view and edit page is on the same.

You can then use template fields with 'labels' only to show the data & place the editing controls(textbox, radio buttons) in edit field templates. You can store a variable in session regarding the user level, then on each page load you can check the level & depending on that, open the formview/detailsView in either normal or edit mode

http://quickstarts.asp.net/QuickStartv20/aspnet/doc/ctrlref/data/detailsview.aspx

http://quickstarts.asp.net/QuickStartv20/aspnet/samples/data/GridViewMasterDetailsInsert_vb.aspx

Answer 4

So no one has better idea?

Answer 5

The Enabled property of the checkbox will remain false even after a tampered postback. Perhaps you could use this in some way?