0

I'm implementing a message system (private messaging, if you will) and I'd like to be able to display the list of messages a user has by a text link so I don't need a button to open it. The message_id (unique value in the databse) would be passed through the URL. (something like www.example.com/message/view/16).Assuming I check to make sure the session of the userid matches the userid that the message is sent to, is this OK? To make it safer I could just append a random number and set that as as session, and then just check for that upon viewing.

Should I forget this idea and just stick with a submit button to view the message?

2 Answers 2

4

A POST request would not provide any more safety than a GET request: any half-decent web debugging tool can forge POST requests. You should simply never trust user-input data. Always double-check authorizations for safety!

That said, GET request semantics match what you're trying to do here.

The HTTP standard says that a GET request should be repeatable without any non-trivial consequence. For instance, it's adequate to view data with a GET request (and possibly do small things like incrementing a counter, since these are pretty trivial consequences). In fact, GETand HEAD are the two request methods that are considered "safe".

On the other hand, POST requests are expected to have non-trivial consequences, like sending a message or placing an order. Stuff that you don't want to perform twice accidentally. Most browsers these days also respect this by warning users when reloading a page would cause a POST request to be performed again.

5
  • Should I still append a random string to the end, set session, and match the session/string upon viewing? Nov 21, 2012 at 1:05
  • @user1104854, I suggest cookies for storing session IDs. The random string would prevent people from legitimately saving the URL. What you really want is to make sure the person reading the message really is the person the message belongs to: you should do that by verifying that the identity of the person is the same as the message's recipient, and you should not base that on additional data passed by the browser. (Also keep in mind that even cookies can be faked.)
    – zneak
    Nov 21, 2012 at 1:07
  • That sounds like it'll work just fine. It's not like I'm storing bank account information, so cookies will do the job. Thanks! Nov 21, 2012 at 1:14
  • @user1104854 I would not apply random string to the end of the URL, as it would prevent the user from bookmarking the page perhaps. You would need to verify that the user has a valid login (probably via data in $_SESSION). If your concern here is over cross-site request forgery (typically mitigated with session token matching hidden form token), then I don't get the concern in this case in that you are not going to be changing any data on the server with this request. The main attack vector here would seem to be session hijacking, which might be mitigated by checking IP address in session.
    – Mike Brant
    Nov 21, 2012 at 1:16
  • @user1104854 And by using things like session_regenerate_id(true) on each page load to swap out the session id.
    – Mike Brant
    Nov 21, 2012 at 1:18
1

Using GET values for viewing messages is much better idea, because assuming a user stays logged in, it would allow them to bookmark messages, etc.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.