Laravel 5 / Form Security (clarification required)

Question

Not quite sure that I understood security in Laravel formats quite well. For example, if the form contains <input type="hidden" name="user_id"> then, obviously, the hacker can change the value before sending the update. Although I looked here in CSRF, I do not quite understand if the protection is enough?

eg. Accepting the above, if I go to the site and open the form for editing the record, I am allowed to view, but not change, and maliciously change the "user_id", is it sufficient that the form is protected with {{ csrf_field() }}or should I use some additional security, for example Crypt::encrypt($id), to hide user_id (stored in the database) and Crypt::decrypt($id)?

Is it bad practice to expose a string id (e.g. user id) in a client browser (although everything is sent via https)?

Many thanks

Answer 1

No, this is not enough to use only the CSRF token. You also need to use policies, safeguards, middleware to protect your application.

In this case, someone can change user_idif you read it from the form and after that use it, therefore, to protect the data you need to use a policy such as this one: from the documentation ):

public function update(User $user, Post $post)
{
    return $user->id === $post->user_id;
}

, , auth()->id() auth()->user(), . .

Answer 2

Laravel CSRF .

, Laravel . , ! :)

Answer 3

CSRF , , . Laravel , , csrf_field() Session:: token(). Laravel .