I have inherited a legacy ColdFusion app with gobs of <input type=hidden> fields, and a user finally may have used F12/Inspect Element to submit a system-valid value in a hidden input that by rights was not supposed to be available. I have coded a session struct to hold the values server-side that used to be hidden inputs, and in case there is DHTML to access or modify the value I've coded cfc methods. A lot of work ahead to implement. Is this a reasonable way or is there a better way?CFC Methods<cffunction name=updSnVal access=remote returnFormat=plain hint=session page variable management>    <cfargument name=pgRand required=1 hint=session page random identifier>    <cfargument name=f required=1 hint=field>    <cfargument name=v required=1 hint=value>    <cfif !structKeyExists(session, pgRand)>        <cfset retVal=-0- Unknown page request>    <cfelseif !structKeyExists(session[pgRand],f)>        <cfset retVal=-3- Field unknown>    <cfelseif structKeyExists(session[pgRand],#f#_valid) and !arrayFindNoCase(session[pgRand][#f#_valid], v)>        <cfset retVal=-1- Invalid value>    <cfelseif structKeyExists(session[pgRand],#f#_mayChg) and !session[pgRand][#f#_mayChg]    or listFindNoCase(valid,mayChg,mayGet, listLast(f,_))><!--- may not change the _valid or _mayChg controls --->        <cfset retVal=-2- Change not permitted>    <cfelse>        <cfset session[pgRand][f]=v>        <cfset retVal=.1.>    </cfif>    <cfreturn retVal></cffunction><cffunction name=getSnVal access=remote returnFormat=plain hint=session page variable management>    <cfargument name=pgRand required=1 hint=session page random identifier>    <cfargument name=f required=1 hint=field>    <cfif !structKeyExists(session, pgRand)>        <cfset retVal=-0- Unknown page request>    <cfelseif !structKeyExists(session[pgRand],f)>        <cfset retVal=-3- Field unknown>    <cfelseif structKeyExists(session[pgRand],#f#_mayGet) and !session[pgRand][#f#_mayGet]>        <cfset retVal=-4- Read not permitted>    <cfelseif structKeyExists(session[pgRand],#f#_mayChg) and !session[pgRand][#f#_mayChg]    or listFindNoCase(valid,mayChg, listLast(f,_))>        <cfset retVal=-2- Change not permitted>    <cfelse>        <cfset retVal=session[pgRand][f]>    </cfif>    <cfreturn retVal></cffunction>UI ColdFusion<cfif structKeyExists(form,pgRand)><!--- goes at the top to either check for or set the session var/val set replacing hidden inputs --->    <cfif !structKeyExists(session,form.pgRand)>        Error: page variables have been disassociated from this page.        <cfabort>    </cfif>    <cfdump var=#session[form.pgRand]#><cfelse>    <cfset form.pgRand=rand()>    <!--- control here the valid values and if OK to remotely change:     *_valid array     *_mayChg boolean --->    <cfset session[form.pgRand]={fld0=^-^}>    <cfset structAppend(session[form.pgRand], {        fld1=val1        , fld1_valid=[val1,val2,val3]        , fld1_mayChg=1        , fld2=Locked        , fld2_mayGet=0        , fld2_mayChg=0    })>    <cfset session[form.pgRand].fld2=X></cfif>UI HTML<form method=post><cfoutput><!--- this input is required for submit to connect with the session.pgRand struct ---><input name=pgRand id=pgRand value=#form.pgRand# type=hidden><br />val:<input name=UiVal id=UiVal value=#session[form.pgRand].fld1#><br /><!--- these inputs do not go on UI page, are in this example just as inputs to directly dictate what field and value to update in session --->fld:<input name=UiFld id=UiFld value=fld1><br /></cfoutput><input name=btnChg id=btnChg type=button value=Change> &nbsp;<input name=btnGet id=btnGet type=button value=Get> &nbsp;<input type=submit value=Display></form>UI jQuery/JavaScript$(#btnChg).click(function(){<!--- this click() is just the event to trigger the update, and the values are taken from this example's UI fields, rather than the needed UI updates on page this is used ---><cfoutput>    $.get(utilMethods.cfc?method=updSnVal&pgRand=#form.pgRand#&f=+$(##UiFld).val()+&v=+$(##UiVal).val(),</cfoutput>    function(data){//data==.1. success, anything else will come with text about what server didn't like        if(data.indexOf(.1.)==-1)alert(data);        //code to handle errors...    });});$(#btnGet).click(function(){<!--- this click() is just the event to trigger get the value ---><cfoutput>$.get(utilMethods.cfc?method=getSnVal&pgRand=#form.pgRand#&f=+$(##UiFld).val()+&v=+$(##UiVal).val(),</cfoutput>    function(data){//data==.1. success, anything else will come with text about what server didn't like        alert(data);        //code to handle errors...    });});
CF/jQ server-side session struct to replace hidden inputs
jquery;html;security;coldfusion;cfml