# Are hidden fields that secure?

**URL:** <https://www.ruby-forum.com/t/are-hidden-fields-that-secure/149420>\
**Category:** Rails\
**Created:** [September 24, 2008, 6:28pm UTC](https://www.ruby-forum.com/t/are-hidden-fields-that-secure/149420 "2008-09-24T18:28:40Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![max](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/e5b9ba/32.png) [@max](https://www.ruby-forum.com/u/max)\
**Post date:** [September 24, 2008, 6:28pm UTC](https://www.ruby-forum.com/t/are-hidden-fields-that-secure/149420/1 "2008-09-24T18:28:40Z")

</div>

Im seeing a lot of my forms having hidden fields to send one or two  
id’s back to the controller. Is this safe? can a user edit this before  
sending the form and send stuff they should’nt?

---

<div class="post-metadata">

**Author:** ![max](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/e5b9ba/32.png) [@max](https://www.ruby-forum.com/u/max)\
**Post date:** [September 24, 2008, 6:32pm UTC](https://www.ruby-forum.com/t/are-hidden-fields-that-secure/149420/2 "2008-09-24T18:32:46Z")

</div>

No, NOTHING that comes from a browser is secure.  
Users can edit and change whatever they want.

You must double check everything against the current login  
stored in the session, since that’s the only secure information  
you have