3 ms·
UUID does not protect your records, that is, it is not a security measure against what you describe.
by oslac 4y ago
UUID does not protect your records, that is, it is not a security measure against what you describe.
- insanitybit 4y agoIt is if you don't expose a 'list' api, only a 'get'.
- adamckay 4y agoUUID is a part of the protection. If your access controls fail then preventing an attacker from enumerating through data by incrementing an integer is protection from Insecure Direct Object Reference. [1] Even if there are no vulnerabilities in access controls it can also prevent competitors from knowing how busy your platform is. If I register a new account on your system and I get ID 57854 and a week later I register another and get ID 57978 then I know 124 new users have signed up in that time. 1 - https://cheatsheetseries.owasp.org/cheatsheets/Insecure_Direct_Object_Reference_Prevention_Cheat_Sheet.html https://cheatsheetseries.owasp.org/cheatsheets/Insecure_Dire...
- victor106 4y agoThank you so much for this.