For REST interfaces or webapps with nice-looking URLs, I constantly ask myself on what numbers to use if we want to refer to specific resources/pages.

A typical approach seems to be to use the unique database ID of a row representing the resource as an index like http://www.mypage.com/questions/4/answers.

Using the database ID would be straightforward, however, it leaks information for resources of other users. I could also imagine that one might generate custom IDs that are only unique to one user to avoid this leaking.

It there any best practice/advice available?


If your primary concern is preventing user X from accessing a resource A that's unique to user Y, then per-user ids don't solve this. What you really need is authentication, i.e. a secure way of verifying that a request for resource A is actually being made by user Y, not just some other user pretending to by Y.

If you don't have authentication, then per-user ids are merely security through obscurity. As soon as user X finds out what user Y's magic id number for resource A is, he can get resource A. If you do have authentication, then per-user ids are unnecessary, as your server can simply refuse to send resource A to anyone not authenticated as user Y.

The only time per-user ids would help is if the id itself is secret information, or indirectly exposes secret information. I can't really think of a scenario where this would actually be the case, but just to be safe I would generate GUIDs rather than incrementing a sequence number, since the sequence number reveals a little information (the order the resources were created in) while a properly-generated GUID reveals essentially nothing.

tl;dr I don't know of any reason why a per-user id would be beneficial, unless for some inexplicable reason you are unable to implement proper authentication or GUID generation.


I presume you are talking about guesstimating urls, that is, replacing my "/4/" with a "/42/" to see if someone else has something under http://www.mypage.com/questions/42/answers".

As far as I know the first and foremost best practice is to implement proper security everywhere, so that a user who does not have permission to see something will never be able to see it, even if they guess its url.

Of course this will not work if you want your users to be able to share their stuff with people who do not have an account on your web site. In these cases, each url has to be public, so you want to make sure it is not discoverable. For this, you can use the second best practice, which is hashing. So, that "/4/" would be replaced with a "/2klty046vjzm9fy/". Many big web sites do it, for example dropbox. Sign up for a free dropbox account, upload a file, ask dropbox to give you its public link, and you will see that its url contains such a hash. Then, upload another file, ask for its public link, and you will see that the hash of that file is completely different, so it is not your own per-user id, it is something unique. Google documents does the same thing for docs that you want to be able to show to users who do not have google accounts.

Judging by your reputation, you probably know how to create a hash; if not, that could perhaps be the subject of a different question.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.