Trusted properties · Question 12 of 12
A form for editing one's own profile sends __identity. An attacker inserts a foreign uid. Which statements are correct?
2 answers are correct. Hard
Show answer
Answer
- A Without your own check, the foreign profile is changed
- D The HMAC of __trustedProperties does not prevent this
Explanation
The property mapper loads the object via the identity and applies the changes. The hash only secures the field names, not the value of the identity. You must check ownership yourself.