Prevent malicious user from executing JavaScript

Question

In my JSP I have a function like fnGetTicketDetails:

function fnGetTicketDetails(record){
    $(\"#TicketNumber\").val(record);
    $(\"#TicketDeta         


        

Answer 1

You can't prevent the user from doing this.

You must treat all input from the user including all requests sent by your JavaScript as untrusted.

That means that the server must verify that the request from the user is legitimate (i.e. it must check if the current user has permission to read the specified detail).

Relying on hidden fields and JavaScript to keep your data secure is a very easy way of getting your data stolen.