During an onboarding process, I want to confirm a user's email address by sending him a link in the form of a URL followed by a GUID as the parameter: www.somedomain.com?p=GUID

What sort of security risk is there in doing so? Note that I'm also validating the user's cellphone number with SMS.

  • onboarding process? user creation? – CaffeineAddiction Jun 8 '16 at 13:25
  • 1
    Is this only to prove that the email is real and the user has access to it, or does the link also grant some other powers to the one who clicks it, like the right to set a password for the account or access any sensitive information? Or in other words, would it be a problem if the GUID leaked? – Anders Jun 8 '16 at 13:30
  • @CaffeineAddiction: yes, for the onboarding process during the creation of a user account. – frenchie Jun 8 '16 at 13:43

This says it better than I can:

the purpose of a GUID is to be globally unique, not to be unguessable.


GUIDs are designed for uniqueness, not for security.

So if you're concerned that an attacker could validate an email address that is not theirs, then do not use a GUID.

Since it is a simple thing to solve, instead generate a 128 bit token using a CSPRNG.

Also use HTTPS to ensure the parameter is encrypted during transit. You should check whether the session matches the original, or ask them to login again after following the link just in case any security products decide to follow the link for scanning before it gets to the user (otherwise they could confirm email addresses for users that never registered).

You should also redirect via HTTP and store the value within their session while you wait for them to confirm, to guard against referer leakage - otherwise any resources on your page from another domain would get your token sent to them within the referer HTTP request header.

| improve this answer | |

There is little security risk in using the method you described for confirming an email address of new accounts, but that's because there is little security risk in general in an invalid email address getting validated. Even if you used a much easier to guess ID than GUIDs, not too much can go badly (from a security point of view) if someone pulls one over on you and signs up with a fake email address, or with someone else's email address.

That being said, I don't think that is the essence of your question. As Anders brushed upon in his comment- is any sensitive information accessible if someone could successfully guess a GUID? Probably not for account creation, but if you use the same type of URL for password resets, then we have more to talk about from a security point of view, as then we can assess the security of the GUID itself.

GUIDs, as their name suggests, are globally unique, and thus you don't have to worry about collisions. They are also 128 bit which makes them difficult to predict. (Note though that some of the bits are reserved so you don't quite have 128 bits of entropy.) That being said, they are generally not impossible to predict, because they usually are generated based on a particular timestamp. If that timestamp is known (or figured out somehow), the number of attempts needed to successfully brute force and find a valid GUID in use is feasible to conquer with modern equipment. This can be mitigated by using short lived expiring GUIDs for sensitive actions such as password resets, but if you're dealing with high security information contained within a user account, then you're probably best off using something other than GUIDs such as a cryptographically secure randomly generated string.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.