How can I create extra protection for passing variables through URL? [JavaScript]

Question

I'm using variable passing through a URL (ie ".derp.html?name=derp?lname=herp") to a popup (which uses these parameters to prefill information on the page). Although these pages are internal, I want to create more security. I do not want someone to type in their own link and submit a form with fake values.

I was thinking of having a function run once the link is opened instead, which opens the popup, and sends the parameters through variables to the new window, instead of through the URL. However, I would still need to send values to the java script function...

Anything else I can do to be more secure?

EDIT: Let me rephrase then... This is not public, this is internal. I'm not expecting users to try and hack into the system to create fake forms.

I can't do server-side validation because I'm working with very old methods like tabular data control in IE. There is no real data base to verify anything.

Preventing users from changing the URL using JavaScript? Are you kidding? — Rob W
– Rob W, Commented Feb 17, 2012 at 15:53
Nothing you do in client-side Javacript will ever be secure. You need to have server-side validation on form submission. — Paul
– Paul, Commented Feb 17, 2012 at 15:54
Given the level of security you are looking for (which is wrong in my opinion), just submit the form using POST method — Pooria
– Pooria, Commented Feb 17, 2012 at 17:22

Diego · Accepted Answer · 2012-02-17 16:02:48Z

2

You can POST the values, instead of appending them to the URL. This is what HTML forms are for. For example:

<form action="derp.html" method="POST" target="myNewWindow">
    <input type="hidden" value="derp" name="name"/>
    <input type="hidden" value="derp" name="lname"/>
    <a href="#" onclick="window.open("myNewWindow");this.parentNode.submit()">Click to open in a new window</a>
</form>

edited Feb 17, 2012 at 16:02

answered Feb 17, 2012 at 15:57

Diego

18.5k5 gold badges67 silver badges68 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Pooria · Accepted Answer · 2012-02-17 15:59:46Z

2

You have two options

1) Instead of using GET method (sending parameter in URL), use POST method and the parameters will not be in HTML URL anymore and you can do it by Javascript. However, a person who want to send fake values to you server, still is able to do so, but it's just a bit harder.

2) Create a hash function(Javascript code) which encode all the parameters before submit the URL and decode it upon received on server side. http://en.wikipedia.org/wiki/Hash_function

Either way, will not provide you 100% security, and still you should perform parameter validation on-server side.

answered Feb 17, 2012 at 15:59

Pooria

7801 gold badge8 silver badges18 bronze badges

Comments

Will Stern · Accepted Answer · 2012-02-17 15:57:07Z

1

you can change it to a post request...but that's about all you can do if the logic is front-side...other than obfuscating the variable names.

answered Feb 17, 2012 at 15:57

Will Stern

17.6k5 gold badges38 silver badges22 bronze badges

Collectives™ on Stack Overflow

How can I create extra protection for passing variables through URL? [JavaScript]

3 Answers 3

Comments

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related