API url security

[Exadra37]

@dorgan

The enumeration issue is of course context dependent, but enumeratig public resources can still be an issue(though not a data breach).

Completely agree

@dorgan

I experienced this myself. My website allows users to post anything, think twitter like platforms. Back when I just used the autoincremented ids in the urls, someone had the brilliant idea of making an “archive” of posts, so you could see the posts even if they were deleted by my moderation team. They would ping at the next id and store it when it’s contents are finally created. Rinse and repeat and they stored posts as they were published. And I didn’t even have an API.

A very good example why numeric IDs must not be used by default

Once they are used by default, by all frameworks in all programming languages, it’s easy to get in the trap of building an application with them without realizing the consequences, until you have problems, like yours.

@dorgan

And sure, it’s quite harmless, like the Internet Archive, but then there’s content that you want to be gone for good(like child porn, doxxed people’s data and other gross/illegal stuff) that is now easily accessible, linked to your brand and completely out of your control.

A good example of how your brand image can be affected and you would not have any control of how to stop it.