Tools / System Design
What is parameter tampering?
Parameter tampering, also known as insecure direct object reference, occurs when attackers manipulate parameters exchanged between client and server to gain access unauthorized access to data.
Examples of parameter values frequently manipulate include:
- cookies.
- URL parameters.
- Drop-down list, Radio buttons and checkboxes.
- database primary fields are stored in hidden fields.
Mitigation strategies:
- Perform resource entitlement checks on every data access request.
- Do not rely on client-provided information for authorization, other than the sessionID. Map sesionIDs to primary keys and other fields as a server side operation.
- Implement tokenization, where the database primary keys are indirectly referenced.
More Related questions...
