Forum Discussion
pcastagnaro_709
Nimbostratus
NimbostratusParameter Tampering
Dear all,
I want to know how can I avoid users to manipulate the URL and circumvent a security permission?
Example, user clicks a link: http://myweb.com/student_data/academic...
pcastagnaro_709Nimbostratus
Nimbostratus
Posted By nathan on 03/12/2013 02:58 PM
Dependant on the answer to Mike's question could a flow policy work for you?
Rgds
N
I think flow policy involves into a vulnerability, because if an attacker wants to access /student_data/academic_data.jsp?studentID=AAA12345 he could do the request, tamper this adding Referer header, and application will show him page requested.
Is that correct?