Which action best protects against parameter tampering?

• A. Encrypt all URL parameters with no validation.
• B. Validate input on the client side only.
• C. Validate all parameters on the server side and enforce strict checks.
• D. Disable HTTPS.

Answer: (C)

Defending against parameter tampering hinges on treating the server as the trusted authority and validating every input there. Attackers can freely alter data sent in URLs, form fields, or hidden inputs, so any checks done only in the browser can be bypassed. Enforcing strict, server-side validation means checking each parameter’s type, format, length, and allowed range, and confirming that the user has permission to perform the requested action. If a parameter doesn’t meet the expected criteria, the server rejects the request rather than trusting the client.

Encrypting URL parameters without server-side validation doesn’t prevent tampering, because an attacker can still craft requests that satisfy the encryption scheme or reuse tokens, and the server must enforce business rules and permissions. Client-side validation is also insufficient because it can be bypassed. Disabling HTTPS would expose data and enable tampering in transit, which is highly insecure.

So, the strongest protection is validating all parameters on the server side and enforcing strict checks to ensure only allowed values and authorized actions are processed.