We frequently need to send entity ids to the client side.
How could we protect this data (especially ids)?
Even if we encrypt using same key every time, it can be identified by analysis.
For example, if I encrypt id "1" to let's say "ae!" (using any algorithm), that same id can be used later on as well.
So should we use session id as key to send data to client side (this will validate data only up-to session is active)? Or could we randomly append a string to id "1", encrypt it and then send to client side (this also can be sent any next time)?
Or is there any other way?
What is best practice for this type of security take care?
I am using .Net MVC C#. But I think question is irrelevant of platform.
Let's take an example.
In the following link id is given in datasource, which is plain text, so any person with technical knowledge can modify it (using developer console of browser).
So IMHO it should be encrypted, to make it unchangeable (because the changed value is not acceptable due to encryption).