jeudi 5 février 2015

Securely passing parameters in JSP/Servlet (No Frameworks)

We have a JSP page and a Servlet page, where we pass the parameters via URL from JSP to Servlet. Below is the JSP link



<a href="OpenServlet?idClient=23">Allergies</a>


In our servlet, we do some process like below.



int id = Integer.parseInt(request.getParameter("idClient"));
//Do the work

RequestDispatcher d = request.getRequestDispatcher("view.jsp");
d.forward(request,response);


Unfortunately this makes the idClient 100% visible and it is also editable. We have noticed that the user can simply edit the idClient from the URL and access other client information too! Not only that, any one can access anyones info, whether the client is belong to them or not!


How can we stop this?





Aucun commentaire:

Enregistrer un commentaire