我怎么能自信地知道用户没有更改文本框值？

Question

I'm working on Wordpress and want to send the user id to the server for process with AJAX. So I store this value ( user_id ) in an hidden input textbox, and every time I read this value, pass it to jQuery and send to server by AJAX. The problem is that users can change this value (by inspecting the page). The below code is one of my attempts:

<input hidden="true" type="text" id="userid" value="<?php echo get_current_user_id() ?>">

<script type="text/javascript">
   $( document ).ready( function(){     
      var previousValue = $("#userid").val();
      $("#userid").keyup(function(e){
      var currentValue = $(this).val();
      if(currentValue != previousValue){
         $('#userid').val(previousValue);
      }
     });
    }
</script>

But apparently it can't be executed when the user inspects the page (via Chrome, Firefox or anything else) and changes the value. How can I authenticate a user id?

Answer 1

This can not be done. You can never guarantee anything about what happens on the client. All the ways to prevent someone tampering with the user ID would rely on the browser somehoe enforcing it, but the client could run any piece of software on their machine . Therefore all security arrangement must rest on the assumption that any data sent by the client can not be trusted.

I guess that what you are trying to do is to identify a user. That can actually be achieved by using PHP session . Store the user id in the PHP session variable instead. If you want, you can pass it to the client, but don't rely on that to enforce any authentication. In other words, don't have the client pass it back to the server.

So, what does this practically mean for you? Wordpress already uses PHP sessions to keep track of the user. When you do an AJAX call, I asume it goes to some PHP page. That PHP script should just get the user id from Wordpress (ie the server) using get_current_user_id() , instead of having it sent from the client.

Answer 2

Follow these steps:

1. Use a hashing technique and hash your userid.
2. Send original userid and hash value to the client system (hidden field can be an option).
3. Send back userid and hash value through ajax from client to server.
4. Hash userid once again using same hashing technique in the server.
5. If pervious hash value match with recent hash value, then nothing tampered.