I'm currently building a webapp with Python's django framework. There is one task that I do not really know how to handle.
Let's say my page displays different questions of users (like tweets on twitter). Now, I want to provide users with the ability to write answers to the different questions displayed. When the users clicks on an answer button below a particular question, a form is displayed below the question with a textarea that can be submitted. When the filled out form with text is submitted and sent to the backend, I need to create a database relationship between the newly created answer and the question. In order to find the corresponding question in the DB its ID is necessary (primary key).
Here is my problem. I do not know where to get the ID from in a safe manner.
An easy way would be to put the ID into the html part of the question and then use it with javascript, or to store the IDs as javascript variables. However, as the DOM and the values of javascript variables can be modified by users on the frontend, this does not appear secure to me. If a user changes the ID value in the DOM for a specific question, fills out the form, and submits it to the backend, the sent ID is not the correct one for this particular question. My DB query using this (maliciously changed) ID retrieves a database record of the questions table that is not the question that the user provides an answer for. For instance, let's say the malicious user provides an answer to question #3, but changes the ID in the DOM, that would be used as part of the form, to #10. The database of questions would then be queried for the primary key 10 instead of 3. Therefore, the created database relationship would then be between question #10 and the posted answer which is not correct.
How is it thus possible to use database IDs in this case without them being subject to any malicious change?
A standard way(I think) to handle this is to use your views/routing. Your detail view for a question already "knows" the ID of that particular question. For example, if your question detail view is like this:
def detail(request, question_id):
question = Question.objects.get(pk=question_id)
then your url_pattern for routing to this view will be like this:
urlpatterns = [
path('<int:question_id>/', views.detail, name='detail'),
]
If you want users to add answers to questions, your view for doing that
should already know the question_id for which the user wants to add answers for. And you give it that knowlege by adding the routing like so:
urlpatterns = [
path('<int:question_id>/', views.detail, name='detail'),
path('<int:question_id>/add_answer/', views.add_answer, name='add_answer')
]
Django basically takes care of the rest for you.
I would suggest going through the views chapter of the Django tutorial. Or the whole tutorial if you have not.