3 ms·

i agree - i cant think of a reason why the user id would ever be in the account url

• grey-area 14y ago
  It's relatively common practice to have an url like this: /yourusername or /users/yourname or /users/32, which shows a public profile, and therefore to have a guessable url for it, and to have a link to edit your account on that page if you are that user. That in itself is not a security problem, but having no access control obviously is.