Is it possible to fake the query-string on postback?

Question

I have ASP.NET page which has a security-sensitive query string. In order to verify it I perform quite heavy calculations in Page_Load. That page has a button and OnClick handler.

Do I still need to verify the query string again if IsPostBack is true?

Answer 1

Yes. In fact almost everything is subject to forgery.

The query string can easily be changed, from the browser itself, the source code, man-in-the-middle attacks, etc.

It is even better to avoid putting sensitive data in the query string, try to use POST as much as possible. (A GET is allowed to be send cross-domain, while POST isn't)