Ids obfuscation between browser and Phoenix framework

Nice Hashid implementation! I’m embarrassed about how I handled doing the same thing now. I was about to write about how Hashid is a great way to deal with this kind of thing. Thank you I will steal this :wink: and pretend I never wrote my ugly hack

Hey all - we created a solution to this a while back and it’s worked very well for us. In seeing this thread I thought I’d publish it for others to use. I would love any feedback as you guys seem to have similar solutions but this aims to be a really, nice simple way for others to accomplish this.

6 Likes

Using UUID for the primary key may be helpful here.

I think either mod_rewrite if you are using a web server (instead of cowboy) or change the method type to POST, which would never post the parameters on the url is the most straight forward thing.

While using POST and body params is a valid strategy to hide sensitive data this topic is most likely talking about identifiers, which are supposed to be exposed in urls, so things like search engines can pick them up.

mod_rewrite is not really something you need with elixir. Usually your application will directly listen for HTTP traffic and route things internally. There’s no need to transform the url to target a single entry file with many get parameters like it’s done for PHP out of historical reasons and how PHP works in general.

1 Like

A search engine wouldn’t index a binary web application. Nor xml queries, because there is no logical storage, so no files to tree. Besides that, it would be senseless if it was possible to index the middle of the application. Because its not a web site, its a program.

So the only reason why there would be a query string if the program was using the method. I wouldn’t think any one would want any side indexing beyond that, because external programs could manipulate the web app.