Some sites utilize a GUID for a file name when it goes in storage. For example, when you load up a receipt, instead of having the receipt named something like 1200 (an incremental number), it will have a GUID instead. What is the purpose of using this GUID if the underlying back-end code permissions checks are in place (User must be admin with receipt reading permissions or must be the receipt owner) instead of leaving in the incremental numbers in place?
Because generating a new GUID is trivially easy, whereas keeping track of which was the last sequence number issued and making sure that the next one is issued only once (no multi-user timing problems) is much more difficult.
Also, a GUID leaks no data; a sequence number discloses the number of files being stored.
You're right that a GUID is unnecessary for security when proper access controls are in place. However, there are still reasons that a GUID can be useful:
- A GUID makes it somewhat more difficult for a malicious user to identify other file records, in case there are vulnerabilities.
- Given a pair of file identifiers, an incremental ID reveals which file was created/uploaded first, whereas a GUID doesn't.
- The GUID option hides the total number of files on the system.
- Some software designs use GUIDs for all objects as part of their design (e.g. applying security descriptors in a non-relational manner to avoid column duplication) such that no two objects have the same GUID regardless of whether the objects are of different types.