Advantage of using hidden variables

[pvsr rao]

What is the advantage of using hidden variables in jsp

[William Brogden]

Hidden variables in forms allow you to follow the state of the user without using cookies or sessions. Since many people try to avoid using cookies as a security measure, hidden variables are more universal.

Disadvantages:
1. Users can easily inspect the values by using "view source" in the browser.
2. You have to program your own equivalent of sessions if user state is anything more complicated than hidden variables can represent.

Bill

[Jeanne Boyarsky]

Originally posted by William Brogden:

Disadvantages:
1. Users can easily inspect the values by using "view source" in the browser.

And worse: technical users can change them.

[Raghavan Muthu]

Originally posted by Jeanne Boyarsky:

And worse: technical users can change them.

means, they can alter them before the values are sent to the server? How is that possible by viewing the source?

[Bear Bibeault]

Copy and paste the page source. Make the changes. Display the page in the browser and submit.

Hidden variables are useful tools, but should never be used for secure values.

[Gregg Bolinger]

Some frameworks will encrypt hidden variable values and decrypt them once returned to the server so it is a bit more secure. But as has been stated, they should never be trusted 100%. Always validate the data on the server no matter what.

[Raghavan Muthu]

That's true. Thank you all