title: How to stop user from changing ID in url to access other records?
body: <p>using asp mvc 4.</p>
  
  <p>When the user goes to a student record, the URL says:</p>
  
  <pre><code>http://studentTracker.org/Record/Student?studentId=380
  </code></pre>
  
  <p>Currently a user can change the studentId right there in the url and get that students record, unless it doesn't exist.  How can I either hide the query string  part of the url, or detect/validate at the controller if the user has changed the url?</p>