如何将无法更改的参数从 java 传递到 HTML

Question

我正在通过 JSON 将一些可选择的图像（人们的照片）从 Java 发送回 AJAX，并以 HTML 格式显示。对于每张图片，我都会发送一个与人的 ID 对应的参数。仅显示他们有权查看的人的图像。选择图像时，此 ID 参数用于获取所选人员的详细信息并将其显示在新的 HTML 页面上。

最大的问题是用户可以轻松更改此参数以显示其他人的详细信息，而他们可能无权访问。我可以通过检查图像 ID 是否在该人有权访问的组中来解决此问题。 However, is there a way to store the ID in such a way that it can not be changed and is still attached to the image so when the image is selected I can access the correct ID and display the details knowing the ID has not been changed由用户？

java代码是：

    String json = null;
    int i = 0;
    int col = 1;
    for (final YouthMember youthMember : youthMembers) {
        String image = youthMember.getPhotograph();
        String name = youthMember.getFirstname() + " " + youthMember.getSurname();

        if (i == 0){
            json = "<div class='row'><div class='col-md-1'><a href='CubAwardOverview.html?id=" + youthMember.getId() +
                    "'><img src=" +
                    image + " height='60' width='60' style='border-style: none' alt='person image' /></a>" +
                    "<div class='caption'> <p>" + name + "</p> </div></div>";
            i++; col++;
        }else{
            if (col > 12){
                json = json + "</div><div class='row'>";
                col = 1;
            }
            json = json + "<div class='col-md-1'><a href='CubAwardOverview.html?id=" + youthMember.getId() +
                    "'><img src=" +
                    image + " height='60' width='60' style='border-style: none' alt='person image' /></a>" +
                    "<div class='caption'> <p>" + name + "</p> </div></div>";
            col++;
        }

    }
    if (col > 0){
        json = json + "</div>";
    }
    response.setContentType("image/jpeg");
    response.setCharacterEncoding("UTF-8");
    response.getWriter().write(json);

Answer 1

一种方法是对参数进行加密，使其无法更改。参考：how to encrypt/encode url parameters in jsp