i suppose a lot of sites don't think too much about it, but putting a user/account id in a url gives away quite a bit of information. putting aside the recomme

i suppose a lot of sites don't think too much about it, but putting a user/account id in a url gives away quite a bit of information. putting aside the recommendations for not putting an internal id in a url just because it may change and break existing links, there are some privacy concerns as well. in a cms-type application, it may let a recently-subscribed customer (or competitor) know how many other customers are stored in the system, even if they can't view the other records. it may also be used to determine a signup date if that is at all useful. in file-hosting type scenarios like dropbox, it allows for brute force scanning like this. instead of using /u/1, /u/2, use the user's username, or a randomly-generated key/guid associated that maps to the user's account.