4 ms·
Yes, internal-use integer PKs are a really good idea, but difficult to scale to user-facing sites securely. Often though, you need an automatic, user-friendly
by burntrelish1273 9y ago
Yes, internal-use integer PKs are a really good idea, but difficult to scale to user-facing sites securely.
Often though, you need an automatic, user-friendly unique id for PK's to give users besides asking the user or generating a text slug.
Here's one construction:
friendly id = HMAC-SHA256(plaintext = "#{table-object-or-model}#{primary-key}", nonce = app-wide-unique-secret-token)
Then in the server app, keep a limited MRU cache (Hash table) of digests back to PKs.
Out-of-scope: authentication, authorization, CSRF/XSS and replay attacks.