4 ms·

…and make sure that the original URL doesn’t include the user ID anywhere - it did in OP’s original example, which means that any attacker could scrape the ID j

…and make sure that the original URL doesn’t include the user ID anywhere - it did in OP’s original example, which means that any attacker could scrape the ID just by watching what the redirect went to (assuming a normal link shortening service was used)

fullstop 5y ago
Right, that was implied. You'd need to rate-limit the shortened URL endpoint as well or increase the number of characters. Without it, you could reset a user's password and brute force all shortened possibilities while entering their username. There'd be enough red flags to identify and stop this type of behavior, I think.
- mewpmewp2 5y ago
  Assuming any of it is being actively monitored.
- chias 5y ago
  How would you rate-limit an unauthenticated-by-definition endpoint?
  - fullstop 5y ago
    By IP. It doesn't have to be limited by much, just enough to discourage brute force attempts.