Prevent change of hidden field

Question

What if I have ChangePassword form with hidden ID field of the user.

BadPerson knows id of GoodPerson. He opens Change Password form with FireBug, changes his Id to GoodP

Answer 1

I agree with Darin that forms authentication will take care of the specific problem mentioned above (changing a password). This answer is for the more general question of making sure that a hidden field's value is not changed.

The best solution to this is to include another hidden field which contains a hash of the first hidden field's value. That way if the 1st hidden field is changed you will know it. The generated HTML looks something like this:

This article shows how to do it and includes source code for an extension Html.SecuredHiddenField which will take care of the logic for you.