0

This question already has an answer here:

For the sake of simplicity, instead of full-fledged authentication with login and password, I want to create "Google Docs long url" authentication scheme for my internet shop for the users. To let them view, track, and possibly modify their own orders:

 my_shop.com/orders/very_long_and_random_string_here/{view|edit|etc}

The very_long_and_random_string_here will have around 50 characters. It'll be unique for each order.

The page will contain user's email and dates. The very sensitive information won't be in the plain text, it'll be partially shown, partially hidden.

Will this url authentication scheme be secure enough?

Are there caveats? Are there serious no-no?

Note that my question is different from How unlikely is it that a Google Doc link is guessed?

marked as duplicate by schroeder Feb 19 at 16:24

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • 1
    "Secure enough" needs to be defined. Secure enough for what? What would happen if unauthorised people had access to that URL? That's the point that matters here. – schroeder Feb 19 at 16:20
  • If you are trying to hide sensitive information from unauthorised people, then yes, this question is a duplicate of the one you linked. – schroeder Feb 19 at 16:21
  • @schroeder I'll rephrase: how likely is it for unauthorised people to have access to that URL? – Kaj Feb 19 at 16:21
  • then this is directly a duplicate of the other – schroeder Feb 19 at 16:21
  • 1
    and why not? can you explain how it's different? – schroeder Feb 19 at 16:22