5

Working on a web app with a token auth system, I'm wondering if giving a user access to view their own user id, a security risk? It won't be viewable easily, they'd have to hash a few cookies first.

Not only looking for answers specific to this implementation, I'm just curious about this in general too.

For my specific case, I'll be using JSON Web Tokens, which means that the UID is view able by the client, but due to the nature of JWT - the token is invalid should the payload be modified.

In this context, guessing someone else's UID by knowing the format of the UID, isn't helpful, since only the uid + the signature form a valid token, and therefore a valid request.

  • Why would the user need to see their UID? Think about the use cases first. – Lucas Kauffman Dec 6 '17 at 6:25
  • 1
    Imagine they see their UID. And they are able to deduce the format of the UID. What happens if they can enumerate someone else's UID, or find a flaw in the implementation of your UID? There are a lot of things to consider here, and not enough information. – Mark Buffalo Dec 6 '17 at 6:32
  • Sorry, I should have been more clear. – Alex Redwood Dec 6 '17 at 6:46
  • @LucasKauffman The user won't ever need to see the UID in order to use the webapp. – Alex Redwood Dec 6 '17 at 6:48
  • @MarkBuffalo I'm using JSON Web Tokens, which means that even if the user could suss out the format, and therefore guess someone else's UID, the token is invalid because the signature is void. – Alex Redwood Dec 6 '17 at 6:48
1

In your specific case it appears not. However in the general sense it depends on how your UIDs are used. If your UIDs are used anywhere in your system as trusted information, and your user can deduce other UIDs from their own, you have a problem. For example, the British company Moonpig made the news a few years ago when it was determined that their user IDs were consecutive, and that a user's ID was sufficient information to request a user's private information including names, birthdays, addresses, last four of credit cards and credit card expiration dates.

If your UIDs are sufficiently random, then leaking them does not decrease security because they provide no additional information about other accounts to an attacker. They would still need to manually enumerate the possible UID space to find valid ones. However, UID enumeration is not especially difficult and so sensitive transactions should always be protected by at least one other private piece of information. In your case that second piece of information is the token which signs the request.

0

If the uid doesnt provide access to anything in and of itself then it doesnt matter at all. As long as you are only retreiving the uid from the jwt on the backend, its fine. Just dont submit it in a post request or query parameter and have your server trust it and you will be fine.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.