Filter
Top Products
Fortinet 430 FortiWeb 5.0 Patch 6 Administration Guide
See also
• Validating parameters (“input rules”)
Preventing tampering with hidden inputs
Unlike visible inputs, hidden field rules are for hidden parameters only, from
<input type="hidden"> HTML tags.
For information on constraining visible inputs, see
“Validating parameters (“input ru
les”)”.
Hidden form inputs are often written into an HTML page by the web server when it serves that
page t
o the client, and are not visible on the rendered web page. Because HTTP is essentially
stateless, like cookies, hidden form inputs are one way that web applications can use to
remember session data from one page request to the next (called “persistence”).
For example, to remember the price of a TV accessed from a secret sale URL previously
requested that s
ession, this form remembers the sale price, and will provide it again to the
shopping cart application when the client submits the payment page:
<form method="POST" action="processPayment.do">
<input type="hidden" name="price" value="900">
$900 x
Quantity: <input name="quantity" size=4><br/>
</br>
<input type="submit" value="Buy">
</form>
Since they are not rendered visible, hidden inputs are sometimes erroneously perceived as safe.
But s
imilar to s
ession cookies, hidden form inputs store the software’s state information
client-side, instead of server-side. This makes it vulnerable.
Hidden fields are accessible through the JavaScript docu
ment object model (DOM).
Additionally, forms often use the HTTP POST method and send input to a URL (such as
/checkPayment.do) that legitimate clients never see, since the server replies with an HTTP
302 status code and the next URL in the Location: header, which the client then fetches
using the GET method and displays. Unless there is code to prevent it, however, attackers often
can easily send altered hidden inputs to this POST URL simply by altering a local copy of the
page, using a browser plug-in tool such as Tamper Data, or in some cases simply typing
different URL parameters into the browser’s location bar.
Like any other input from clients, it can be tampered with and should not be trusted. Tampered
hidden
input
s can be used as a vector for state-based attacks.
To follow the above example, an attacker could alter the sale price so that he or she can buy the
item much
more cheaply:
<form method="POST" action="processPayment.do">
<input type="hidden" name="price" value="1">
$900 x Quantity: <input
name="quantity" size=4><br/>
</br>
<input type="submit" value="Buy">
</form>