如何保护传递给另一个页面的查询字符串或参数

Question

I have a scenario which displays list of products in a tabular format and one of the column has a link to the product page.

<td> <a href="/ViewProduct/{{$request->prd_ID}}/{{$request->usr_ID}}" id="link" > Product </a> </td>

The route is as follows:

Route::get('ViewProduct/{pid?}/{uid?}', 'ViewProductController@Page_Load');

and the URL would be:

http://example.com/ViewProduct/11/4

This approach directly exposes the product id and user id and can be modified easily in the browser. Any inputs on how to address these concerns in php/laravel?

Answer 1

This is really not something you should worry about, it's a pointless waste of time. Somebody changes the URL from a 2 to a 3 and they'll see a different page... so what?! If they're allowed to see that page in the first place, ie if they could click around on your site and eventually discover this page, then what's the issue? They just took a shortcut. If they're not allowed to see that page... well, you're doing authorisation checks when someone is requesting that page, aren't you? If you are, then there's no issue at all. If you're not, then that's your real problem. Trying to keep URLs "secret" and "unguessable" is impossible, just do proper authorisation checks.