0

For the sake of simplicity, instead of full-fledged authentication with login and password, I want to create "Google Docs long url" authentication scheme for my internet shop for the users. To let them view, track, and possibly modify their own orders:

 my_shop.com/orders/very_long_and_random_string_here/{view|edit|etc}

The very_long_and_random_string_here will have around 50 characters. It'll be unique for each order.

The page will contain user's email and dates. The very sensitive information won't be in the plain text, it'll be partially shown, partially hidden.

Will this url authentication scheme be secure enough?

Are there caveats? Are there serious no-no?

Note that my question is different from How unlikely is it that a Google Doc link is guessed?

  • 1
    "Secure enough" needs to be defined. Secure enough for what? What would happen if unauthorised people had access to that URL? That's the point that matters here. – schroeder Feb 19 '19 at 16:20
  • If you are trying to hide sensitive information from unauthorised people, then yes, this question is a duplicate of the one you linked. – schroeder Feb 19 '19 at 16:21
  • @schroeder I'll rephrase: how likely is it for unauthorised people to have access to that URL? – Kaj Feb 19 '19 at 16:21
  • then this is directly a duplicate of the other – schroeder Feb 19 '19 at 16:21
  • 1
    and why not? can you explain how it's different? – schroeder Feb 19 '19 at 16:22