title: Form action integrity strategies/patterns in PHP?
body: <p>I'm using Symfony 2.2 and I have a situation where there are several users who are allowed to edit a resource. My resources have IDs and the path looks like this <code>/resource/edit/{id}</code> where <code>{id}</code> is the id that the resource has in the database.</p>
  
  <p>My forms is displayed when a GET request is made to that path and processed when a POST request is made. Now since all users are equal and no resources are owned by one, there can be a situation where a user is editing the form for <code>resource #2</code>, but then changes the form's action parameter to <code>/resource/edit/5</code>. The POST request would then change the values for <code>resource #5</code> instead of <code>resource #2</code>. Currently this is just a risk that is taken and in the end they are messing up stuff for themselves, but I would still like to restrict this.</p>
  
  <p>One strategy I thought of was setting a flash session variable with a certain value which was based on the resource ID, and then sending that value also with the form. On the next request I would check that the value in the flash session variable matched the one coming from the form, and checking that the ID derived from the variable matched the resource id that use POST is trying to edit. The problem with flash data is that I think it might disappear when the user makes a request in another browser tab in between. Perhaps encrypting/hashing the intended action (with a salt) with the form would work?</p>
  
  <p>Are there any time-tested patterns/strategies or perhaps even Symfony2 services that would serve to check that the form kept its intended action/resource/ id in the edit request.</p>