how to pass sensitive data from view to controller

Question

In order to construct an entity with quite a lot of information, I need to performe a sequence of forms submitting. Every time I return a view from a controller, I need to pass some id's about the not yet established entity. Right now I inject these pieces of info into hidden fields, and when post back to server, continuing to construct the entity. This scenario continues for a few times. I'm very not satisfied with this way of passing sensitive information, and was wonder if there're other more appropriate ways of doing it. I use authorization and authentication, but still worried of some scenarios in which one user could hack these id's, before sending it back to server, and by that, modifying the wrong entity.

Also, seems kind of hard work to pass back and forth the same data. I disqualified the use of sessions, because it reveals a different kind of data disruption threat . (in case of using more than one browser at a time).

How should I perform the mentioned operation?

Answer 1

You can use a secure hash of the data in another hidden field to detect tampering with the values.

Here is an example of how to generate a cryptographically secure hash http://www.bytemycode.com/snippets/snippet/379/

Answer 2

You can secure your data using many approaches, I discussed some of it in this post

http://miroprocessordev.blogspot.com/2012/03/save-aspnet-mvc-application-against.html

http://miroprocessordev.blogspot.com/2012/03/safe-aspnet-mvc-application-against.html

Answer 3

use Cross-site request forgery with token to identify that everytime u send an info it contains same token generated at server side and returned from your html