hack proof html coding with ajax

Question

I have many lists e.g. a todo list, a shopping list etc. on my web page. I am using AJAX to add or delete the items. For example, for a todo list my HTML is like:

<tr id="todo_userttypea_23"> <td>name</td><td>Delete</td></tr>

Note if the users press delete then I am deleting that row.

I get the id of the row and then break it to find which operation to perform and which id to delete.

But the I have found that if I use firebug then I can change the id dynamically to any number and I have found that it is possible to delete any id, even if does not belong to that user, by editing the HTML.

What should I do to prevent this?

Answer 1

Perhaps you should check to see, on a delete ajax request, whether the user doing the deletion is permitted to delete the item.

Answer 2

I think you are confusing Javascript functionality with security. If your user is not allowed to delete AuntMarysShoppingList#32, then the server shouldn't let him no matter what the client requests.

You can obfuscate your JS code, but on some level, you have to assume your user is an honest broker, and isn't going to go out of their way to delete something (the hard way, by hacking JS) that they have the rights to delete anyway.

Answer 3

You need to add Authorization checking on the server side. Whether the request is ajax or otherwise is irrelevant.

Answer 4

The main principle is "never trust incoming data". Any data you get sent from outside can be manipulated - Parameters, Headers, Referers, everything. A good and safe system does not trust any of these.

If you have multiple users working on the same data base, you will probably need to implement an authorization system that defines clearly who is allowed to do what to which record.

That is usually done using a session-based login system of some sort, based on one of the scripting languages like PHP, Ruby, ASP or Perl. There are pre-built solutions available.

Answer 5

You basically need something like this on the server-side:

if (itemBelongsToUser(itemId, currentUserId)) {
    deleteItem(itemId);
}