title: Prevent Url Tampering to access another users data
body: <p>I just wanted to gauge opinions on how I should approach this problem and ultimately looking for a quick win (wrong way to think about things nut time pressures mean I have to think and act quickly!</p>
  
  <p>I've been given a website that has a bit of an issue.</p>
  
  <p>I login using standard forms authentication as User1234 and my url is as follows:</p>
  
  <p>www.mywebsite.co.uk/1234/Contact.</p>
  
  <p>This will take me to User1234's details. </p>
  
  <p>You can put two and two together and correctly assume that 1234 is a user id of some sort.</p>
  
  <p>Once authenticated, I can access the views with [Authorize] attribute present, any anonymous/unathenticated users get redirected.</p>
  
  <p>However, once logged in as User1234, I can then tinker with the url like so:</p>
  
  <p>www.mywebsite.co.uk/1235/Contact.</p>
  
  <p>So I am authenticated as User1234 but can see User1235's data. This is BAD for obvious reasons.</p>
  
  <p>When I log in, I actively set the login ID in session so in theory, I could do a check whenever a user hits an ActionResult, I could cross check the ID present in the URL against the session login ID. However, it is a rather project with lots of action results and as such, I'm reluctant to spend my Saturday afternoon adding something to each and every ActionResult.</p>
  
  <p>Is there an event in the global.asax I could use that is hit on each ActionResult request where I can compare Session login ID with url ID?</p>
  
  <p>Alternatively, can anyone offer some suggestions about how I can achieve this or restrict URL tampering?</p>