Help, how to add security to my page?

jfernandez

Hi, I am currently designing a website. One of the page of it is displaying the member's profile. The link for the page would be something close to this,
http://www.mysite.com/profile.php?id=6

I do not want the user to change the id of 6 to 7 in the URL and be able to view the next profile.

Another page in of my site is displaying a certain message other membership send to the logged in user. The link for the page would be something close to http://www.mysite/com/private_message.php?id=10. User can change
the id from 10 to other number to view messages not intended to the user.

My question is should I change add the ids from digit to a 32 character long encrypted string or should I use a one-time generated URL to increase the security?

I would be appreciated if someone with more experience could give me some hints. Thanks.

Joaquin

Weedpacket

You'll notice on these forums that anyone can view anyone's profile just by picking the right ID number. Changing the profile isn't so open: to change a user's profile you have to be logged in as that user.

So there's your solution. To protect the profile page, check that the user ID matches the ID of the logged-in user who's requesting it.

Better yet, since you already have the ID of the logged-in user, use that instead of some other number passed in through the URL.

jfernandez

thanks for the reply. I will use the logged in user's ID from the session variable and check his/her previledge.

Eric_T

Also if you have a view link don't just make it a href, change it to a form using the post method then you can't change the id in the url.

Weedpacket

Eric T wrote:
Also if you have a view link don't just make it a href, change it to a form using the post method then you can't change the id in the url.

But if you're using the logged-in user's ID, there's no other ID that needs to be passed in the first place - in the URL or in a form. Go to your own user preferences page in this this forum and you'll see what I mean.

Eric_T

I agree, I was just presenting another option... guess I could have worded it better 🙂