</div>
</div>
</div>
<hr class="my12 outline-none baw0 bb bc-powder-2">
<div class="grid fw-nowrap fc-black-600">
<div class="grid--cell mr8">
<svg aria-hidden="true" class="svg-icon iconLightbulb" width="18" height="18" viewbox="0 0 18 18"><path d="M9.5.5a.5.5 0 0 0-1 0v.25a.5.5 0 0 0 1 0V.5zm5.6 2.1a.5.5 0 0 0-.7-.7l-.25.25a.5.5 0 0 0 .7.7l.25-.25zM1 7.5c0-.28.22-.5.5-.5H2a.5.5 0 0 1 0 1h-.5a.5.5 0 0 1-.5-.5zm14.5 0c0-.28.22-.5.5-.5h.5a.5.5 0 0 1 0 1H16a.5.5 0 0 1-.5-.5zM2.9 1.9c.2-.2.5-.2.7 0l.25.25a.5.5 0 1 1-.7.7L2.9 2.6a.5.5 0 0 1 0-.7z" fill-opacity=".4"></path><path opacity=".4" d="M7 16h4v1a1 1 0 0 1-1 1H8a1 1 0 0 1-1-1v-1z" fill="#3F3F3F"></path><path d="M15 8a6 6 0 0 1-3.5 5.46V14a1 1 0 0 1-1 1h-3a1 1 0 0 1-1-1v-.54A6 6 0 1 1 15 8zm-4.15-3.85a.5.5 0 0 0-.7.7l2 2a.5.5 0 0 0 .7-.7l-2-2z" fill="#FFC166"></path></svg>
</div>
<div class="grid--cell lh-md">
<p class="mb0">
<b>Want to improve this question?</b> Update the question so it can be answered with facts and citations by <a href="/posts/23946618/edit">editing this post</a>.
</p>
<p class="mb0 mt6">Closed <span title="2014-05-30 05:41:13Z" class="relativetime">5 years ago</span>.</p>
</div>
</div>
</aside>
I have a simple form with three input fields for posting messages into specific group:
The submiting is done using Ajax and sending input text and hidden fields
What I do: The text send by the user is validated. I check if the token match with the session token created for that form.
The problem: The hidden id (group id) can be changed by the user and post will insert into the wrong group.
I can remove the hidden id and get the group id from the session. But i'm not sure if this is secure
</div>
Yes that is secured, session variables reside on the server not on the client side. Although, if the user can be under a certain group, you could query or look it up in the database upon submitting instead of saving it in the session. If you have other form or page that the user can access and change his/her group, then the group id in your session will be invalid.