3 ms·
What is the benefit to users of having folder names in the URL? Seems like it totally avoids the issue if a unique ID or encrypted name is used.
by MichaelGG 10y ago
What is the benefit to users of having folder names in the URL? Seems like it totally avoids the issue if a unique ID or encrypted name is used.
- chrismorgan 10y agoIt makes the browser history more useful. And it’s nicer to look at (people do still see URLs in many browsers).
- brongondwana 10y agoIt actually doesn't totally avoid the issue, because you're still leaking information unless you use a different ID for every request. Someone looking at referer logs can see that you accessed two different things from the same folder. There's also the u= parameter which tells which user you are. That _is_ obfuscated, but it has the same correlation issue, it's the same for forever for a single user, so you could tell that it's the same user looking at different URLs. (we use the u= parameter both for supporting multiple concurrent logged in users on the same machine, and as an extra layer of CSRF protection)
- MichaelGG 10y agoWell if it was just an opaque identifier then it'd not need to leak anything other than the same item being used multiple times. But point taken, thanks.