how to avoid browser parameter values?

[Simpson Kumar]

in one of my jsp page, we used logic:iterate tag with "edit", "remove", and "view list" like the following .

 <logic:iterate id="myCollectionElement" scope="session" name="<%= WebConstants.SCHOOL_LIST %>" indexId="counter">  
         <tr height="20">
       <td width="40%"><b><bean:write name="myCollectionElement" property="schoolListName"/></b><td /> 
       <td width="20%"> <html:link page="/editSchoolList.do" paramName="myCollectionElement" paramId="schoolListId" paramProperty="schoolListId" >edit</html:link></td>
       <td width="20%"> <a href='javascript :-o	 nDelete("<bean:write name="myCollectionElement" property="schoolListId" />")'> remove</a> </td>
<td width="20%"> <html:link page="/schoolList.do?method=viewSchoolList" paramName="myCollectionElement" paramId="schoolListId" paramProperty="schoolListId">  view list</html:link></td>
</tr> 
       </logic:iterate>    

when I click on edit link on any one record, in the browser i see

http://localhost:9080/SchoolListBuilder/editSchoolList.do?schoolListId=5    

with the value (schoolListId=5) and if anyone make change on browser with another number instead 5 and press enter, then automatically the corresponding record edit page is displayed and he can do edit page which is absolutely wrong.

Is there any way to avoid parameter through browser? actually I tried with method post but no use.

could some one give me solution .

[Christophe Verré]

actually I tried with method post but no use.

No use ? Why ? What went wrong ?

[Chengwei Lee]

Originally posted by sumant kuchipudi:
when I click on edit link on any one record, in the browser i see

http://localhost:9080/SchoolListBuilder/editSchoolList.do?schoolListId=5    

with the value (schoolListId=5) and if anyone make change on browser with another number instead 5 and press enter, then automatically the corresponding record edit page is displayed and he can do edit page which is absolutely wrong.

This isn't really a problem of the users being able to change the parameter values from the URL locator. It is more of an authorization issue. If the record is something this user shouldn't be seeing, you should be checking that and disallowing him from seeing. So even if he does try to change the value into something else and attempts to browse it, your application logic will determine that he is not authorized to view/edit that record and stop him from doing so.

You're trying to solve the issue in a wrong manner.

[Simpson Kumar]

thanks Chengwei Lee;

Now Im just verifying that schoollistid is corresponding to the current user or not. if not, just throwing a exception on him and a message.

ok this solution is good, but i think its not right solution. Can we avoid that browser parameter in any other way?

I used struts logic:iterate and put the parameters from there, I dont know why post is not working
I put method=post but still the browser displaying the parameter.

[Reghu Ram Thanumalayan]

Look like this is an open issue with <html:link> tag, that only HTTP GET is supported.

JIRA issue

What you could try as an alternative to <html:link> is to define a form with POST and add hidden fields with the id and trigger the submit of the form with javascript when the edit link is clicked [ ]

[Chengwei Lee]

ok this solution is good, but i think its not right solution. Can we avoid that browser parameter in any other way?

Why do you think this is not the right solution? Your problem here lies in that the user is able to access records not he is not supposed to. So this is an authorization problem, isn't it?

Even if you are able to use HTTP POST, there is no stopping someone who is determined enough to alter the values of the parameters. They just need to capture the request and alter the values. So regardless of using GET or POST, it doesn't stop someone from changing the parameter values.

[Simpson Kumar]

hi Lee,
you are absolutely right, we must follow the authorization in order to avoid the changing request parameters from browser. I think I will keep my solution as it is.

thank you very much for your time and replies.