> > I was wondering what the best method is to confirm that the
> > form variable that are submitted were from a page from the
> > server and not some hacker downloading the source and
> > changing stuff. I know you can use CGI.HTTP_REFERER, however
> > this is not always passed by all browsers. Any Ideas.
>
> If it's important enough you can pass a form variable with an
> encoded string that uniquely identifies THIS form that you
> handed out. When the form is submitted you validate that the
> encoded string is the same one you gave out, and you don't
> let them be used twice.
That won't stop someone from tampering with the contents of the form that
one time, which is all that's really needed. The underlying issue is
unavoidable - if you allow someone to communicate with your web server via
HTTP, you can't hide data from that person. All data sent to the browser is
transparent to that person, and all data from the browser is subject to
tampering by that person.
Dave Watts, CTO, Fig Leaf Software
http://www.figleaf.com/
voice: (202) 797-5496
fax: (202) 797-5444
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Structure your ColdFusion code with Fusebox. Get the official book at
http://www.fusionauthority.com/bkinfo.cfm
Archives: http://www.mail-archive.com/[email protected]/
Unsubscribe: http://www.houseoffusion.com/index.cfm?sidebar=lists
