Sorry, I am still new to Django, hopefully the question isn't out of place.

When I have the following in my template:

```
<td><a href="/contact/edit/?id{{ item.id }}">{{ item.last_name }}</a></td>

```

By clicking on last name the user will be redirected to the following link in order to edit it.

```
http://127.0.0.1:8000/contact/edit/?id=1

```

But then what prevents any logged in user to just inject a different id in there on the browser and edit a record that doesn't belong to him?

**Update**

I just had an idea when I read the comment and answer below. Rather than using a third party app, couldn't I just create a UserProfile for each user and attach a unique company wide uuid.uuid1(). Each time a loggedin user attempts to edit something, his unique company uuid will be also passed in the link as an additional parameter.

On the edit side, it would harvest this guid and compare it against the logged in user and see if they match. If they do match, he is authorized to proceed with the editing, otherwise he will be redirected.

What do you think? Any weaknesses?