表单提交时追加隐藏字段是否更优？兼谈隐藏字段篡改风险

Short answer: No, it does not eliminate the tampering risk. Here’s why:

• Users can set a breakpoint in their browser’s DevTools on your submit handler, pause execution right after you add the hidden field, and modify its value before the form is sent.
• They can inject custom JavaScript to listen for the form’s submit event and overwrite or add fields after your code runs.
• Most critically, users can completely bypass your frontend. They can inspect the network request your form makes, then use tools like Postman, curl, or the browser’s "Edit and Resend" feature to send a custom request with any student_id value they want.

Frontend security measures are never sufficient for protecting sensitive operations like updating records. The only reliable way to prevent unauthorized or tampered submissions is to validate everything on the backend:

• Check user permissions: Verify that the currently logged-in user has the right to modify the specific student record (e.g., a teacher can only edit students in their class, an admin can edit any student).
• Validate data integrity: Confirm that the submitted student_id actually exists in your database, and that the record is associated with the user’s permissions.
• Avoid trusting frontend data: Don’t rely solely on the student_id from the request to determine which record to update. Whenever possible, derive context from the user’s session (e.g., if a student is editing their own profile, fetch their ID from the session instead of the form).

For example, instead of this insecure backend logic:

UPDATE students SET name = ? WHERE id = ?; -- Blindly using student_id from frontend

Use something like this:

-- First verify the user has access to the student
UPDATE students SET name = ? 
WHERE id = ? 
AND class_id = (SELECT class_id FROM users WHERE id = ?); -- Use session user ID for validation

内容的提问来源于stack exchange，提问作者mike