Here is what I want to do: We create reports for customers, normally we send them as pdf to our customer who then shares them with colleagues across his company. We want to switch now to digital reports.
- The report is accessible only via URL with UUID
- When the user clicks on the link, he is redirected from https://example.com/uuid/ to https://example.com/customer/report/
- The second domain checks the http referer for the UUID. We make this redirection to prevent the problem when the user clicks in the report on an external link that the other server has the UUID in their referers logs.
- We create the UUID v4 with the NPM Package UUID
- Everything is via https connections
(edited to avoid duplicates)
- Can crawlers find the UUID if it isn't posted anywhere?
- Is my solution to redirect to separate report page to avoid the problem with UUIDs being exposed in the request URL effective?
Why don't we use username / password? Simply because at the end with sharing the report these credentials are shared in emails as well. And either we make a long secure password or the client makes it but then there is a good chance that he has to share one of his standard passwords.