title: Spring MVC and Thymeleaf Prevent Entity Id Leak
body: <p>I have <code>Demand</code> entity. I can update my entity without any problem but I think my approch have some security problem.</p>
  
  <p><strong>demandController</strong></p>
  
  <pre><code>@RequestMapping(value = "/details/{id}", method = RequestMethod.POST)
  public String updateDemand(@PathVariable("id") Long id, @Valid @ModelAttribute Demand demand, BindingResult result) {
      if (result.hasErrors()) {
          return "demandUpdateForm";
  
      } else {
          demand.setDemandId(id);
          demandService.updateDemand(demand);
          return "redirect:/demands";
      }
  }
  </code></pre>
  
  <p><strong>serviceImpl</strong></p>
  
  <pre><code>@Override
  public Demand updateDemand(Demand demand) {
      return demandRepository.save(demand);
  }
  </code></pre>
  
  <p><strong>form</strong></p>
  
  <pre><code> &lt;form id="vendorForm" th:action="@{/demands/details/__${demand.demandId}__}" th:object="${demand}" method="post" &gt;
  </code></pre>
  
  <p>As you see I get <code>DemandId</code> from action. For example I want to update 5th id's <code>demand</code> and get the update form. Then I changed <code>demandId</code> via developer tools and click submit. If I modify id for example 2nd and form update my 2nd id <code>demand</code> not original the 5th one. How can I prevent this situation. </p>