hashing form fields to prevent tampering

Question

I have a front end form for entry creation. I have a few options I don't want tampered with. The docs for |hash say "Prefixes the given string with a keyed-hash message authentication code (HMAC), for securely passing data in forms that should not be tampered with."

I've tried a dropdown field:

<input type="hidden" name="fields[businessStatus][]" value="{{ 'created'|hash }}">

When |hash is added the page just reloads instead of going to the correct redirect URL. So I tried a plain text field with |hash and a hashed string is submitted instead of the string before the filter. I'm guessing this is why the page reloads for the dropdown field, what's being submitted doesn't match one of the field's values.

What am I doing wrong? Am I misunderstanding how |hash works?

Also, it says "Prefixes the given string", what if you need to protect a integer?

Answer 1

If you're posting to Craft's EntriesController->saveEntry(), then it doesn't do any hash validation.

You'd need to post to a controller of your own (from a plugin or module if you're on Craft 3), then validate the data yourself like the example in the docs you linked to:

$foo = Craft::$app->request->getPost('foo');
$foo = Craft::$app->security->validateData($foo);

if ($foo !== false) {
    // data is valid
}

Then your controller would manually save the entry similar to how Craft does after your validation.