check user security for modifying objects
<p>I am thinking about security implementation for my python web app.
For example I have user and profiles.
Each user can edit his profile by sending POST at /profile/user_id</p>

<p>On every request i can get session user_id and compare it with profile.user_id if they not same - raise SecurityException().</p>

<p>But I also can do it another more common way: 
generate for each profile </p>

<pre><code>secret = hash(profile_data+secret_key)
</code></pre>

<p>and render for auth. users links like this:</p>

<pre><code>/profile/4?key=secret
</code></pre>

<p>So idea is to generate secret key based on editable object data and check this key on server side. If user don't know secret key it can't get links to edit other profile, and so can't modify them.</p>

<p>How this method of protection called?
Has it any problems in comparsion with session based user_id check?</p>

<blockquote>
  <p>/profile/4?key=secret</p>
</blockquote>

<p>Practical issues:</p>

<ul>
<li>it's generally a bad idea to put a secret in a URL. URLs leak easily through logs, history, referrers etc. Also it breaks navigation. It's better to put the secret in a cookie or POST data.</li>
<li>you would typically include a time limit in the signed data, so tokens aren't valid forever</li>
<li>you would typically include some kind of flag/counter/state on the user information and in the signed data, so that a user can update something (eg change password) to invalidate previously-issued tokens</li>
<li>you also have to ensure that the lifecycle of signed data can't be longer than that of the token, eg that you can't delete user 4 and create a new user 4 for whom the token is still valid</li>
<li>the hash you would use would be an HMAC using a server-side secret for the key</li>
</ul>

<p>Signed authentication tokens are typically used as an alternative to database-backed session storage, for performance or operational reasons. It's certainly possible to do sessions securely with signed tokens, but if you're already using stored sessions for other purposes anyway you don't have a lot to gain.</p>

python security web-applications