title: restful Web Parameter Tampering
body: <p>I am trying to understand how I can implement security using a restful client for an authenticated user. The scenario I am having trouble is how to stop a user from updating a purchase that's not his own since the restful client passes a purchase id back. The product id can be easily tampered with for a skilled user. I am not really interested in being caught in the middle since using https prevents that or mitigates it. I am really interested in a user trying to update what's not theirs.</p>
  
  <p>How do you prevent such attacks in the rest world? <a href="https://www.owasp.org/index.php/Web_Parameter_Tampering" rel="nofollow" title="Web Parameter Tampering">Web Parameter Tampering</a></p>