2 ms·

> I think putting internal PK's in URLs or anything else publicly exposed is a bad idea Why? Both as a user and as a dev I love that I can just change the PK

• jrochkind1 5y ago
  I mean, the links are going to be a template either way, so you can change the identifier part to change the item; it's just a question of whether the identifier portion is the internal rdbms PK, or something else. It's considered undesirable because it's basically an "implementation detail", it's good to let the internal PK change without having to change the public-facing URLs, or sometimes vice versa, when there are business reasons to do so. And then there are the at least possible security implications (mainly "enumeration attacks") and/or "business intelligence to your competitors" implications too. But it's true that plenty of sites seem to expose the internal PK too, it's not a complete consensus. Just kind of a principle to separate internal implementation from public interface. Here's a short 2008 HN discussion on it, in which people have both opinions: https://news.ycombinator.com/item?id=19876901 https://news.ycombinator.com/item?id=19876901 Here's a more recent and lengthy treatment: https://czep.net/21/obfuscate.html https://czep.net/21/obfuscate.html
  • Semaphor 5y ago
    Thanks, especially those links are helpful, will read through it :)