3 ms·
Do you have security concerns besides someone guessing the id? I always figured you just make sure you only allow authenticated users to edit/view the data they
by Quarrelsome 17y ago
Do you have security concerns besides someone guessing the id?
I always figured you just make sure you only allow authenticated users to edit/view the data they are authenticated to see.
I always figured people used GUIDs over ids to avoid the performance implications of re-pinging the database to get the new id.
I would be cautious of creating my own GUID generation though. I'd assume that the db's GUID implementation is probably WAY better than anything one can hack together within a short time-frame.
I'm an auto-increment man (if I can get away with it). :)
- Rust 17y agoMy concern with security stems from the eventuality of exposing that identifier to a viewer, most likely through a link - maybe to their profile page, or (for example) to a specific node or post. More commonly, that ID would turn up as a hidden form field on a comments form, a simple right-click away. I would expect that good authentication would negate the worry about this, but I don't always see every side of things ;)
- elptacek 17y agoAny value that you use to look up user information to populate a template is going to expose some information about how your application works, whether it's incremental or a GUID or a hash. There is some value in not having it be incremental in that it's not as easily fuzzable, but spidering the site will still cough up a bunch of valid values for the 'userid' parameter. Even if the form field is hidden. What are you writing, anyway?