Bumped by Community user
    Tweeted twitter.com/StackSecurity/status/939184029609406466
2 more context to the situation
source | link

Working on a web app with a token auth system, I'm wondering if giving a user access to view their own user id, a security risk? It won't be viewable easily, they'd have to hash a few cookies first.

Not only looking for answers specific to this implementation, I'm just curious about this in general too.

For my specific case, I'll be using JSON Web Tokens, which means that the UID is view able by the client, but due to the nature of JWT - the token is invalid should the payload be modified.

In this context, guessing someone else's UID by knowing the format of the UID, isn't helpful, since only the uid + the signature form a valid token, and therefore a valid request.

Working on a web app with a token auth system, I'm wondering if giving a user access to view their own user id, a security risk? It won't be viewable easily, they'd have to hash a few cookies first.

Not only looking for answers specific to this implementation, I'm just curious about this in general too.

Working on a web app with a token auth system, I'm wondering if giving a user access to view their own user id, a security risk? It won't be viewable easily, they'd have to hash a few cookies first.

Not only looking for answers specific to this implementation, I'm just curious about this in general too.

For my specific case, I'll be using JSON Web Tokens, which means that the UID is view able by the client, but due to the nature of JWT - the token is invalid should the payload be modified.

In this context, guessing someone else's UID by knowing the format of the UID, isn't helpful, since only the uid + the signature form a valid token, and therefore a valid request.

1
source | link

Is a user being able to view their own UID a security risk?

Working on a web app with a token auth system, I'm wondering if giving a user access to view their own user id, a security risk? It won't be viewable easily, they'd have to hash a few cookies first.

Not only looking for answers specific to this implementation, I'm just curious about this in general too.