Never Use a Display Name for Authorization: Secure Anonymous Editing

Public polls, surveys, and collaborative boards often ask participants for a name. The name helps other people understand who submitted each response. It should not grant permission to edit that response. A display name helps humans identify a participant. It does not prove that an incoming HTTP request came from the person who created the record.... Weiterlesen