security - Django: preventing external query string requests -

security - Django: preventing external query string requests -

i've been doing web development few months , maintain having nagging problem. typical pages request content query string contains meaningful info such id in database. illustration link such as: http://www.example.com/posts?id=5

i've been trying think of strategy prevent users manually entering value id without having accessed link--i'd wish acknowledge requests made links presented on website. also, website may not have authentication scheme , allows anonymous browsing; beingness said, info isn't particularly sensitive still don't thought of not beingness able command access information. 1 option, suppose, utilize http post requests these kind of pages -- don't believe user can simulate post request may wrong.

furthermore, user place arbitrary number id , end requesting record doesn't exist in database. of course, validate requested id wasting resources accommodate check.

any thoughts? i'm working django general strategy programming language good. thanks.

first, choosing between , post: user can simulate kind of request, post not help there. when choosing between 2 best decide based on action user taking or how interacting content. getting page or sending info (a form obvious example)? case of retrieving sort of post, appropriate.

also worth noting, right selection if content appropriate bookmarking. serving url based solely on referrer -- say, "prevent users manually entering value id without having accessed link" -- terrible idea. cause innumerable headaches , not nice experience user.

as general principle, avoid relying on primary key of database record. key (id=5 in case) should treated purely auto-increment field prevent record collisions, i.e. guaranteed have unique field records in table. id field backend utility. don't expose users , don't rely on yourself.

if can't utilize id, use? mutual idiom using date of record, slug or both. if dealing posts, utilize published/created date. add together text field hold url friendly , descriptive words. phone call slug , read django's models.slugfield more information. also, see url of article on news site. final url http://www.example.com/posts/2012/01/19/this-is-cool/

now url friendly on eyes, has google-fu seo benefits, bookmark-able , isn't guessable. because aren't relying on back-end database fixed arbitrary id, have freedom to...restore backup db dump, move databases, alter auto-increment number id uuid hash, whatever. database care, not programmer , not users.

oh , don't over-worry user "requesting record doesn't exist" or "validating requested id"...you have anyway. isn't consuming unnecessary resources. how database-backed website works. have connect request data. if request incorrect, 404. webserver non-existent urls , you'll need non-existent data. checkout django's get_object_or_404() ideas/implementation.

django security query-string http-get