Take the 2-minute tour ×

Let's say I have a form that POSTs to the same URL that generated the form. Let's also say that the URL is somedomain.com/contractor/1/1/add-workers and it's really important that the URL remain unchanged during the lifetime of the form.

So I set the form's action="." as the form is meant to POST to the same URL.

Under what circumstances can this leave my action attribute vulnerable to manipulation / fiddling by users? Let's say the user manually changes somedomain.com/contractor/1/1/add-workers in the address bar to somedomain.com/contractor/1/2/add-workers before POSTing the form, I think that has no repercussions, but what other circumstances should I keep in mind where the action attribute can be affected (unintentionally) by the user?

share|improve this question
The user activating their browser's developer tools and changing the action to whatever they like? Or simply POSTing a custom request to the server by using any other external tool? You cannot prevent this. If there are security repercussions then you have to be able to solve them purely on the server. –  Jon Feb 5 '13 at 11:27
anyone can do this or its login based? –  Toping Feb 5 '13 at 11:27
Changing the URL in the address bar without hitting return won't have an effect. As @Jon has said though, you can't prevent them from opening up their developer tools and changing the action attribute manually. –  BenM Feb 5 '13 at 11:28
Yes, that is impossible to prevent I guess. @Ark - it's login based. –  chefsmart Feb 5 '13 at 11:29
@chefsmart you can check the user and compare to a permission-table –  Toping Feb 5 '13 at 11:30

Your Answer



Browse other questions tagged or ask your own question.