Spring MVC和Thymeleaf防止实体Id泄漏(Spring MVC and Thymeleaf Prevent Entity Id Leak)

 我有Demand实体。 我可以毫无问题地更新我的实体，但我认为我的approch有一些安全问题。 
 
 demandController 
 
@RequestMapping(value = "/details/{id}", method = RequestMethod.POST)
public String updateDemand(@PathVariable("id") Long id, @Valid @ModelAttribute Demand demand, BindingResult result) {
    if (result.hasErrors()) {
        return "demandUpdateForm";

    } else {
        demand.setDemandId(id);
        demandService.updateDemand(demand);
        return "redirect:/demands";
    }
}
 
 serviceImpl 
 
@Override
public Demand updateDemand(Demand demand) {
    return demandRepository.save(demand);
}
 
 形成 
 
 <form id="vendorForm" th:action="@{/demands/details/__${demand.demandId}__}" th:object="${demand}" method="post" >
 
 如你所见，我从行动中得到了DemandId 。 例如，我想更新第5个id的demand并获取更新表单。 然后我通过开发人员工具更改了demandId并单击“提交”。 如果我修改id例如2nd和表单更新我的第二个id demand不是原来的第5个。 我该如何防止这种情况发生。 

I have Demand entity. I can update my entity without any problem but I think my approch have some security problem.
 
demandController
 
@RequestMapping(value = "/details/{id}", method = RequestMethod.POST)
public String updateDemand(@PathVariable("id") Long id, @Valid @ModelAttribute Demand demand, BindingResult result) {
    if (result.hasErrors()) {
        return "demandUpdateForm";

    } else {
        demand.setDemandId(id);
        demandService.updateDemand(demand);
        return "redirect:/demands";
    }
}
 
serviceImpl
 
@Override
public Demand updateDemand(Demand demand) {
    return demandRepository.save(demand);
}
 
form
 
 <form id="vendorForm" th:action="@{/demands/details/__${demand.demandId}__}" th:object="${demand}" method="post" >
 
As you see I get DemandId from action. For example I want to update 5th id's demand and get the update form. Then I changed demandId via developer tools and click submit. If I modify id for example 2nd and form update my 2nd id demand not original the 5th one. How can I prevent this situation. 

原文：https://stackoverflow.com/questions/37533894