Take for example a simple messaging system. Users can send each other personal messages. When reading a personal message sent to you, the URL would be something like
http://www.example.com/messaging.php?mailid=453796451. I see many websites retrieving data using only a unique identifier, like
45379451 in this case. If someone else would known this unique identifier, he would be able to read the private message sent from user A to user B.
Now my question is if such an id passed via the URL is really secure? In this case the id consists of 8 numbers, which would mean that a hacker would have to try 100,000,000 numbers at a maximum, in order to read the private message. But if the database stores one million private messages, the hacker would be able to read a private message roughly every 100 attempts. Is it therefore a bad idea to make the system only rely on the id passed via the URL, or is it devious to check if the user matches the message's recipient?
I am programming a private messaging system at the moment, and I was wondering what would be the best practice to do so.
Sorry if my title is a bit misleading, I couldn't think of another way to describe this problem.