how to prevent tempering for hidden field value by malacious user.

Question

hi all actually i am using the hidden field for storing some value

<asp:HiddenField ID = "hfObjectID" runat="server" />
<asp:HiddenField ID = "hfIsBestanswer" runat="server" />

hfObjectID.value = // fetching pk_id from data base.
hfIsBestanswer.value =  // fetching pk_id from data base.

<input type="hidden" value="100" id="ctl00_ContentPlaceHolder1_ucComment_hfObjectType" name="ctl00$ContentPlaceHolder1$ucComment$hfObjectType">

here 100 is actual value Now user change it 200 now send to the server on server side code will perform operation for 200 value insted of 100 .........

suppose on client side hidden field value changed by user then it cause the bad for storing some data on server side acording to hidden field value... so how i can prevent it. is there any logic which i have to implement itself......

thank you.

Answer 1

Don't store anything in a page that would cause problems if it were to be modified in a manner which you can't check for on the server side.

Rather than storing this value in a hidden field it would be more appropriate to store it in the user's session on the server side.

Answer 2

I agree with Jamie that you shouldn't store any sensitive data to hidden fields. But if you still decide to do so, you should use some digest algorithm to fingerprint data stored in hidden fields. You can find more info here: http://advosys.ca/papers/web/60-form-tampering.html