Best and secure way to send parameters in URL

Question

I am working on a website in which there would be functionalities to update and delete data on the basis of id. Now the thing I am worried about is like my url would be

www.example.com/public/controller/action/1

if the action would be delete, any person can change id from 1 to 2 in url and the data with id 2 would get deleted. What would be the best way to keep the flow secure. I am using Zf2 and Doctrine2... Any suggestions please !!! And moreover I am keeping ids hidden in fields, anybody can use firebug to change the value in fields, is there any way to protect data from that too?

Would any encryption-decryption way would make it secure, like if anybody even edits the encrypted value, after decrypting it would not result in a required id? Which one would be good, I have never used encryption decryption.

Answer 1

You can change id to some_random_string (based on timestamp to make it unique) and search databese for that. There is no chance that user would guess that random string. And second check in controller that logged user have rights to CRUD actions.

You can use https://github.com/ZF-Commons/ZfcUser (with second module for Doctrine) to make auth and in controller you can check if user is logged

if ($this->zfcUserAuthentication()->hasIdentity()) {
    $user = $this->zfcUserAuthentication()->getIdentity();
    if($user->systemRole=='admin')//you can make switch for that
    {
      //can edit/delete/create
    }
}

To make this work you must copy UserEntity from that module and add systemRole. (check documentation for zfc-user for that)

Answer 2

The most secure way to send a url with data is over a secure connection with ssl (https). However, I don't think this is the question you are meaning to ask.

I think you are wanting to prevent certain people or groups of people (roles) from accessing certain resources. If this is the case, you need an access control list, and you should use the \Zend\Permissions\Acl component.

Edit:

The best way to encrypt data in PHP is to use a modern reversible-encryption functions like mcrypt_encrypt and mcrypt_decrypt.

However, this is simply obscuring the url, it does not fully protect you from someone simply making a robot to check all the delete urls available (given, there may be quite a few).

The only bulletproof way of protecting certain pages (resources) is to use some type of access control. Say for instance, you only want a particular user to be able to delete their own posts. You could have an action deleteMyPost. (I am presuming you have a user login to the site in order to perform actions, otherwise, all bets are off). When someone goes to www.mysite.com/public/controller/deleteMyPost/1, the action or the ACL will check if the id of 1 is a post of the logged in user. If not, the user will be redirected away from the page in some fashion, maybe with a header('Location: <url>') call.