Hi all,

I’m hoping for some insight into a strange issue.

Our app’s Ecto repo is configured to use as primary keys UUIDs in the standard 8-4-4-4-12 format. The app periodically sends out emails with links to resources, such as /orders/<order_uuid>. Emails are generated using Bamboo with EEx templates for both HTML & plain text and sent via SendGrid.

In over 99% of cases, everything appears to work as intended. However, the app occasionally logs an Ecto.Query.CastError error after someone visits a URL that contains an odd string in place of the UUID. Here are a few typical examples: “NjBlNjhlZW”, “MjA1MDNhZT”, “NmMzYzhiZT”, “ZDQzNDYwZj” - 10 characters, upper- and lower-case letters, rarely containing a number. Given their format, these are clearly not carelessly copy-pasted UUID fragments but something else entirely.

None of the supposedly affected users have contacted us, so we can’t connect these strings to UUIDs that should have been in those links.

Is it possible that these links are actually generated by the app when it interpolates UUIDs into the URLs? Could it have something to do with character encoding used by certain email clients? Do these 10-character strings ring any bells at all?

Any help or hints towards a possible explanation will be much appreciated.