News for hackers. Stuff that matters.

A comment on Database IDs Have No Place in URIs (2008). Parent comment

Re:Database IDs Have No Place in URIs (2008) by paulryanrogers on Friday May 10, 2019 @09:01AM (#19877287)
> Database ids on the URL are also a security concern.

More so than in mark up? If so why?

Should surrogate keys never be exposed to users in any form? Then what's the alternative? Nonces for everything, all the time?

[ Parent | on HN ]
Re:Database IDs Have No Place in URIs (2008) by luckylion on Friday May 10, 2019 @09:03AM (#19877304)
> More so than in mark up? If so why?

Easy to enumerate, if that's a concern.

[ Parent | on HN ]
Re:Database IDs Have No Place in URIs (2008) by dqybh on Friday May 10, 2019 @09:13AM (#19877370)
In the case of URLs, you can have /questions/:id/:slug, and then load the question by :id, but if :slug doesn't match the slug you've got in the database, then return 404.
[ Parent | on HN ]
Re:Database IDs Have No Place in URIs (2008) by luckylion on Friday May 10, 2019 @09:20AM (#19877422)
Sure, but that means that you have a unique key combination of id + slug for all intents and purposes. The argument for having the ID is that the slug can change and you can redirect. If you don't redirect, that argument falls flat, and if you redirect you're easier to enumerate.
[ Parent | on HN ]