title: Laravel 5/ Form security (require clarification)
body: <p>Not entirely confident I have understood security in Laravel forms enough. For example, if a form contains 
  <code>&lt;input type="hidden" name="user_id"&gt;</code>
  then obviously a hacker could change the value before submitting an update.
  While I have looked <a href="https://laravel.com/docs/5.5/csrf" rel="nofollow noreferrer">here</a> at CSRF, I've not fully understood if this is enough protection?</p>
  
  <p>E.g. Taking the above, if I go to a site and open a form to edit a record I'm permitted to view but not change, and maliciously alter the "user_id", is it enough that the form is protected with  <code>{{ csrf_field() }}</code> or must I employ some further security such as <code>Crypt::encrypt($id)</code> to hide the user_id (held in a database) and <code>Crypt::decrypt($id)</code>?</p>
  
  <p>Is it considered a bad practice to expose a row id (like a user id) in a client browser (even though everything is sent over https)?</p>
  
  <p>Many Thanks</p>