3 ms·
Another way to solve enumeration attacks is to use a two-way hashing algorithm to convert your auto-incrementing integer IDs to a hash of arbitrary length. This
by mikece 4y ago
Another way to solve enumeration attacks is to use a two-way hashing algorithm to convert your auto-incrementing integer IDs to a hash of arbitrary length. This is essentially what YouTube is doing with their video IDs and it's a low-CPU, low-complexity solution that prevents/severely deters enumeration attacks.
Here is one such library for C# https://github.com/ullmark/hashids.net https://github.com/ullmark/hashids.net
- tpetry 4y agoHashids sounds like hashing but it‘s just encoding and decoding the values. I shared that approach in the article. They have the drawback that you always need to decode manually the url when you e.g. want to lookup a record from an URL.
- CharlesW 4y ago> They have the drawback that you always need to decode manually the url when you e.g. want to lookup a record from an URL. Do you? Why not just also store the hashid in the row as an “external ID”?