为Ajax调用实现安全性

Question

I am facing difficulty in making my Ajax request secure. The problem is Data tampering. I have read about this problem and it is suggested that never trust the information what ever is coming from client. It can be very well changed using fiddler or any such tool. We need to validate in server side as well. But my question is how to validate.

Let's see one example. Suppose I have Employee information in database and I have exposed one method GetEmployeeDetailByEmployeeId. Before any employee make this request he will be authenticated with userId and password and authorized whether user of this type are allowed to make this request or not.

But if one employee gives employeeId of some other employee, he will actually gets the data which he is not supposed to see. To fix this issue we have two solution 1. We should check the request against the database, whether the information requested by the person is meant for him or he is the manager of that guy 2. We should somehow validate in app layer itself whether we should reject the call or not.

First approach is performance intensive where I have to make database request and finding the association of record, also it will add cost to development.

Pls suggest which way to go and do we have any better solution to solve this kind of problem.

Answer 1

Clearly you need to check it at your back-end side, otherwise your application is likely to exploit by a kid.

Update

you need to implement an authorisation mechanism in your back-end, then after you load the permissions at the beginning, you can add it to the user session, so you don't need to look-up the database each time, you just need to check the user permission against the task required permission.

More

To implement the authentication mechanism: Goal, user can see it's own profile but supervisor can see everyone within his department .

• user A has the user_id already loaded at the session, let say user_id = 123
• user A can only request his information so if (user_id == req_user_id) then show the information, otherwise show error.
• user B has the permission value of 100 , let's call him supervisor then. Now if (user_id == req_profile_id) is not true we will check the permission. Let say the task permission for this particular task is 10 so if (user_perm >= task_perm) , go ahead and check the department, if both the requested user and current user are at the same department, then show the information, otherwise show an error.

this should works based on your information.