Right way to use md5 secrets in confirming ok-ness of URL requests? When to clear the secret? <p>I have some cases where I need to put a URL into a web page that, when clicked on, will fire some handling code on the server. I obviously want to prevent random bad guys from constructing their own URLs and doing things they shouldn't, so I'm working with this scheme, reverse-engineered from stuff I've seen on other sites:</p> <ul> <li>make a unique string (I'm using MD5, but there doubtless other options)</li> <li>put this string into an appropriately named session variable</li> <li>include the string in the URL, maybe something like <code>/do_this/123/FABDYFYEYYDFBDHDFS</code></li> <li>when the handling code runs, extract the string from the url and compare it to the value of the session variable -- if it matches, we should be safe to proceed. If not, do something else.</li> </ul> <p>This is working OK for me, except for the part where the user's browser's session storage gets littered with no-longer-relevant session variables. There are some cases where I can (and do) delete a session variable once I'm done doing what I'm doing, but not always. I could probably be a little more clever about finding opportunities to clear the old variables, but the problem seems general enough that there may be a better way to do this (i.e., what I've come up with could be really stupid for any number of reasons I haven't thought of). Is there any advice out there for a good/better way of doing this sort of thing?</p>