7 ms·
My concern with security stems from the eventuality of exposing that identifier to a viewer, most likely through a link - maybe to their profile page, or (for e
by Rust 17y ago
My concern with security stems from the eventuality of exposing that identifier to a viewer, most likely through a link - maybe to their profile page, or (for example) to a specific node or post. More commonly, that ID would turn up as a hidden form field on a comments form, a simple right-click away.
I would expect that good authentication would negate the worry about this, but I don't always see every side of things ;)
- elptacek 17y agoAny value that you use to look up user information to populate a template is going to expose some information about how your application works, whether it's incremental or a GUID or a hash. There is some value in not having it be incremental in that it's not as easily fuzzable, but spidering the site will still cough up a bunch of valid values for the 'userid' parameter. Even if the form field is hidden. What are you writing, anyway?