3 ms·
But then by default you are leaking potentially business sensitive data with your id if you are using it as public facing, which is unsecure design by default.
by mewpmewp2 2y ago
But then by default you are leaking potentially business sensitive data with your id if you are using it as public facing, which is unsecure design by default.
I would rather have secure data by default and opt in to optimise when it is clear this info is fine to leak.
- sgarland 2y agoSee other reply; I don’t believe that exposing this is as big an issue as people think. But even with that, there’s also no reason to do so. Internal ID friendly to the DB and eternal, random ID that does get exposed is a common practice. Or use JWE/JWT, and never show either.
- mewpmewp2 2y agoI don't know. Is it not? I frequently check out of curiosity when I'm buying something the order numbers and similar things that might of interest, if I notice integers. I imagine if you become a public company that would be very sensitive information in terms of the company is doing, and there would be strong push to check for that data, to get an advantage in the stock market. It doesn't seem right to me to expose with such ease how many sales you are doing. It's definitely not intentional to expose it.
- lazide 2y agoAuto increment ID’s also leak information. Random UUID’s shouldn’t, but will impact performance, which in most cases will have more concrete impact on the business. There is no such thing as a free lunch.