Protecting POST data in a web application

Question

I have a web application that has basic authentication - username, password, session, and more. However, I have a definite need to prevent users from substituting POST requests (even for registered users). In my application, I specifically check the user session before accepting POST data (also taking care of XSS, etc.).

how

if(user session exists)
{
    // handle the data POSTed
}

else {
   // ...
}

I store session identifiers in a database. Is there anything else I should know about to prevent false POST requests or is that enough?

Answer 1

I specifically check the user session before taking POST

, ": , cookie, , , . cookie , POST () .

, , - XSRF, ( ), GET POST . . ( , HTTP-, .)

, (SQL, ) (HTML, JavaScript) , , : - , , , XSRF.

XSRF, , . , .

. , , . , PHP:

<form method="post" action="delete.php"><div>
    <input type="hidden" name="key" value="<?php echo(htmlspecialchars($user['key'])); ?>"/>
    <input type="submit" value="Delete" />
</div></form>

if ($_POST['key']!=$user['key'])
    // error

, /, .

- , . , , . , , , ( ).

Answer 2

. , , .

Answer 3

POST- Javascript , , POST . , POST. , .

, . . , .

Answer 4

CAPTCHA .

REST, . - POST, .

, CAPTCHA .

Answer 5

, , . , , - , SHA1 , , . , .NET .

Answer 6

, - XSRF. .

.NET, AntiForgeryToken,

http://msdn.microsoft.com/en-us/library/dd492767.aspx

Answer 7

, , , , , mysql_real_escape_string ($ MyPostData).

, /, POST, , .

, , "" : , , , , .

Answer 8

( , ), (, , - , ), /guid, , , cookie. , , , GUID , . XSRF.