If things should be secure, they should be behind authentication and authorization for that content. To argue about what is the best ID to be used is just trying to fix what is not broken, IMHO.

Security is multi layered.

Obscurity is not a security layer.

Obscurity is a perfectly fine security layer as you said yourself (i.e. it is one of many layers).

Relying ONLY on obscurity is a failure.

So a password or private encryption key isn't security?

What is a UUID if not a fairly predictable object-based shared authorization token?

EDIT: I'm mostly kidding.

Just call it an object-specific API key, that forms part of the URI instead of being a header value. Since we are using https it's all good.

I think a cryptographic hash is fine.

If you know the hash, you likely already know the file.

A cryptographic hash of what?

Cryptographic hashes aren't random by nature.

The document, from what I could glean they were PDFs.

Edit: even if they aren't PDFs, you can feed the content to the hash function.

I suppose that might work but seems needlessly complex compared to just a long securely generated random number.

Yeah, randomly generated IDs are fine for most use cases IMO, and perhaps more importantly they’re easy to implement well enough—grabbing 256 bits from /dev/urandom isn’t bad.

With a hash it’s more expensive to compute the ID, but you get advantages such as content-addressability, data integrity without trust, and easily mergeable databases. It’s a good amount of bang for not much more buck.

At the cost of leaking more metadata in the ID, by including a checksum/namespace, you can recognise a valid ID or determine the type of object it refers to without fetching anything from storage, mitigating some DOS attacks.

IDs are a subtle thing, and in my experience, often overlooked as a design issue. A lot of times it ends up as something like “id integer primary key autoincrement” without any thought.

A better approach would be to not put private data in the public domain.

Generally you generate a random UUID which is quite difficult to enumerate.

>Many UUIDs aren't secure either and can be trivially enumerated.

uuidv4

uuidv4 is random assuming your rng source is random

And assuming you're legitimately getting a UUIDv4 instead of a UUIDv1 or UUIDv2 now and forever...