New answers tagged

1

Giving away information in the URL An URL might be accessible even to a person that is not supposed to have access to the actual page it leads to. After all URLs can show up in links all over the web or leak via referer headers. Therefore there should be no sensitive information in the URL. The Mongo ID contains information about the time the object was ...


1

The OWASP mentions that simply having any sort of direct identifier can be bad, as explained in the Top 10 2007-Insecure Direct Object Reference and Top 10 2010-A4-Insecure Direct Object References entries. An attacker that can figure out how to exploit such an direct reference will have far more power than they should. The OWASP actually recommends using ...


1

I can't think of any real security risk to exposing the mongoDB id (versus some other counter id), other than exposing creation time according to the server to the users. Having the mongo primary key vs some other unique key (like a counter) shouldn't make a difference in terms of exposure. Granted you should be aware, the mongo _id consists of: a ...


1

This exposes meta information in the MongoDB ID as stated in the answer from dr jimbob which is a security concern in some aspects. Another way to post this question is What is the best practice for not exposing meta information about the entries in my DB in links and URIs? The answer to that question is simple: Use a unique identifier field for the ...



Top 50 recent answers are included