I have an app which uses rotating numbers to keep track of different clients, i.e. requesting /client?id=123, /client?id=124 etc. will allow any authenticated user to view any clients details. For various reasons we need to virtually patch this until in can be properly fixed in the next production cycle. I thought of fixing this via mod-security catching the 'id=###' in the server response and encrypting it on the way out and decrypting it before handing it off to the server on the way back in. Is mod-security the right tool to implement this? Can someone point me to some documentation that explains how to implement this?

Thanks

- Jay