3 ms·
Holy schmolies, yes. And if you use them as your access keys for, say, a webservice, people aren't really going to be able to fish around the same way they can
by megaman22 9y ago
Holy schmolies, yes. And if you use them as your access keys for, say, a webservice, people aren't really going to be able to fish around the same way they can if you use auto-increment integers.
If your url looks like https://awesomeunicorn.com/userProfile/123 https://awesomeunicorn.com/userProfile/123, it's pretty obvious that I could start poking around and trying to get user 122 or 124. If that url is https://awesomeunicorn.com/userProfile/123456-dead-beef-abba-0123456789ab https://awesomeunicorn.com/userProfile/123456-dead-beef-abba..., I don't really have any idea what the ID of the next user might be.
- pletnes 9y agoThe downside is that your urls are long, ugly and incomprehensible.
- zxcmx 9y agoThe upside is that your business is not totally transparent to outsiders who can figure out how many users, carts, products and messages you are adding each month.
- pletnes 9y agoThere must be some other way. I can often figure out the direct url to a software project in bitbucket, but office365 urls are pages long. I somehow doubt atlassian is as transparent as you say. Disclaimer: not a web dev
- llao 9y agoIf trying more or less random URLs of your service is an issue for you, you have an issue.
- megaman22 9y agoTrue, you absolutely should have security and authorization setup. But if the server replies to the request with a 401 or 403, rather than a 404, you at least know that there is something there.
- kuschku 9y agoThis is a massive issue with pastes on GitLab. Unlisted, private, public snippets all get links such as https://gitlab.com/snippets/1712835 https://gitlab.com/snippets/1712835 If you have an instance with few users, you can just create a new snippet and then auto-decrement. e.g. I just found https://gitlab.com/snippets/17128 https://gitlab.com/snippets/17128 this way.