How can I protect my asp.net Handler page

Question

I'm using this practice to add comments using AJAX , by sending the data to an ASP.NET Handler which collect the information and then insert the comment, but I am afraid that any one could use it , am I wrong !?

    //AddComment.ashx
    public void ProcessRequest (HttpContext context) {
    CommentsDB db = new CommentsDB();
    db.InsertComment(new Comment(context.Request["name"].ToString(), context.Request["comment"].ToString(), "no", int.Parse(context.Request["id"].ToString())));

    context.Response.ContentType = "text/plain";
    context.Response.Write("succeed");
}

        //Comments.js
        function AddComment()
    {
        n = document.getElementById('txtName').value;
        c = document.getElementById('txtComment').value;
        i = document.getElementById('ctl00_ContentPlaceHolder1_thread').value;
        m = document.getElementById('ctl00_ContentPlaceHolder1_Label1');
        if(n == "" || c == "" || n.length > 100 || c.length > 400)
        {
            m.innerHTML = "<center><font color=black size=3><b><font color=red>*</font> An error has occurred</b></font></center><br>";
            return;
        }
        m.innerHTML = "";
        document.getElementById('btn').disabled = true;
        $.post("./Handlers/AddComment.ashx", {'name':n, 'comment':c, 'id':i}, function(Response){
            m.innerHTML  = "<center><font color=black size=3><b>accepted</b> <img src=./Images/success-icon.png></font></center><br>";
        });         
    }

Answer 1

Your assumption is correct, that your users can potentially make their own HTTP requests to your handler, and provide bogus data. They could also manipulate your page markup in their browsers (with any developer toolbar) and do the same.

So, you're going to want to do some validation on your server side if you're worried about this. If your application requires authentication, just look up the current user's name in the handler's ProcessRequest method, rather than posting it.

I think that's what your question is getting at. Also, clean up your markup, center and font tags are deprecated.

Answer 2

If you require that the commenters to be logged in than check for the actual user (stored on the web server - in session for example).

Or if you allow non authenticated comments, than consider using some captcha to protect against automated requests.