Security with QueryString values in Asp.net MVC

Question

How do you properly ensure that a user isnt tampering with querystring values or action url values? For example, you might have a Delete Comment action on your CommentController which takes a CommentID. The action url might look like /Comments/Delete/3 to delete the comment with the id 3.

Now obviously you dont want anyone to be able to delete comment 3. Normally on the owner of the comment or an admin has permission to do so. Ive seen this security enforced different ways and would like to know how some of you do it.

Do you make multiple Database calls to retrieve the comment and check that the author of the comment matches the user invoking the delete action?

Do you instead pass the CommentID and the UserID down to the stored procedure who does the delete and do a Delete where UserID and CommentID equal the values passed in?

Is it better to encrypt the query string values?

Answer 1

You cannot easily do this.

I have fond memories of a site that used action urls to do deletes.

All was good until they started search crawling the intranet.

Ooops, goodbye data.

I would recommend a solution whereby you do not use querystrings for anything you do not wish to be edited.