0

I've read that passing GUID as URL parameter isn't considered insecure because usually, an app has an authentication mechanism (checking against some session token).

However, how secure would an application be if the user's page can be accessed just by the GUID in the URL and there's no login / authentication at all? This GUID is quite long (about 16 characters) and the user base at a time would just be about 10,000. It's also a time-based access (e.g. users can only access this special user page for the duration of X hours).

  • ... because if the URL is captured, anyone can log in to that user's page? – schroeder Jul 31 at 10:16
  • why not send as POST data? – schroeder Jul 31 at 10:17
  • The url is probably saved in history, so anyone who can access that can access the page, like friends or if you access on some public computer – Artog Jul 31 at 11:18
1

what are the security risks?

The security risk is that there is no security at all to begin with.There is a reason why authentication exists.

Now lets assume that GUID is sufficiently long enough such that brute force is out of the question.But it still gets logged in so many places.

But the real threat is more from powerful crawlers that search engines have.A simple google search might leak the credentials of all the users.Plus without authorization or authentication how would you separate user space from one another.Its like an open website where anyone can be anyone without proving who they are.

  • If as I've mentioned the access is just for a limited time? (then all GUID will be revoked after e.g. 3 hours) It's sort of a temporary page for a user that will be used to see some info pertaining to themselves. – catandmouse Jul 31 at 11:24
  • So like your facebook/gmail account being open for a few hours? – Vipul Nair Jul 31 at 13:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.