Aura open custom tab Aura and parameters

Question

I have a aura and I need to open a custom tab Aura that I already create and send some parameters without send in the URL, because of the possibility that someone change the URL and access data that is not allowed.

I tried this example but I don't want to create a event for that (myEvent variable):

({
    doInit: function(component, event, helper) {
        var myAttribute = component.get("v.myAttribute");
        var sendData = {
            param1: 'value1',
            param2: 'value2',
            myAttribute: myAttribute
        };
        var myEvent = $A.get("e.c:myevent");
        myEvent.setParams({
            "sendData": sendData
        });
        myEvent.fire();

        var navService = component.find("navService");
        var pageReference = {
            type: 'standard__component',
            attributes: {
                componentName: 'c__MyLWCComponent'
            },
            state: {
                c__receivedData: sendData
            }
        };
        navService.navigate(pageReference);
    }
})

How can I achieve this solution and get this parameters in the other aura?

Answer 1

What you've just described is listed as a vulnerability known as A01:2021 – Broken Access Control. If the user can view data they should not, you have a security vulnerability. Historically, a common example was from PHP, where there were variables like $_SESSION, $_QUERY, and $_REQUEST. Some developers would use $_REQUEST instead of $_SESSION, and subsequently you could just add ?admin=1 to a URL to become a system administrator. Validation should be done server-side, including checking permissions, rather than relying on obscuring secrets. Passing values by URL should be safe enough for most use cases.