2

I have seen some posts on the subject of hidden input fields for use with postbut none were able to answer my question.

I have a delete button tied to a user in a table. The delete button uses a hidden input combined with post. The value of this input is a primary key for the users table. Im sure this creates some vulnerabilities. If this creates a vulnerability, should I hide the value? Do I need to use a different method to complete the same task?

  • Does hiding the value gain anything? – James McLeod Dec 16 '19 at 16:24
  • @JamesMcLeod the only thing I would gain is that a malicious user wouldnt be able to see the deleted users primary key. My concerns come from a malicious use somehow altering the value of this field to delete a user that was not meant to be deleted. – FamousAv8er Dec 16 '19 at 16:53
  • @JamesMcleod I use prepared statements and sanitize my inputs but I want to make sure Im taking all precautions. – FamousAv8er Dec 16 '19 at 17:04
  • But won’t a malicious user look at the HTML and JavaScript and see what’s going on? Hiding the field provided much less protection than you think. – James McLeod Dec 16 '19 at 17:09
  • 1
    All security has to be handled on the server side. Hiding fields etc can be done if it improves UX but don’t let it provide you with a false sense of security. – James McLeod Dec 16 '19 at 17:15
4

From a security standpoint, a hidden input field is just as secure/insecure as a simple text box that gets pre-populated by your application. This means that you should not put sensitive information that you don't want to become known into an input field of a HTML form.

There is always a risk that a user will deliberately or accidentally change the value of a hidden input field. This means that even for hidden input fields, you cannot blindly trust that the value you receive is valid, but you have to actively check. For your delete button/form, this means you have to check in the POST handling that the user making the call actually has the permissions needed to delete the user indicated by the form values.

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.