1

I'm building a note-taking app, when a user writes a note an id is generated and I redirect them to a page where they can see its content with a URL like /note/DXSt832pS5iLuos6uxBn. What are the security risks of not double-checking that the user has access to this page, and simply trusting that if they know the id they're authorized?

The id is an autogenerated id from firestore. I found this answer speaking about how it should be as unique as a guid and crypo quality random.

2

1 Answer 1

1

Properly done the risk of using such a unique link without additional authentication is low. Properly done means that

  • Only authenticated users are redirected using such a link and only to resources they should be able to access
  • Since the link is intended for the redirect only it should be very short lived. This means it should be invalidated after visit (i.e. redirect was successful) and/or after a short time. Thus even if the users shares the link voluntarily or involuntarily (attack) with somebody else, the other person should not be able to access the content
3
  • Thanks! If the link isn't short live, in my case the guid is the resource id, I assume the risks increase a lot? I assume an attacker or the network admins could see the links?
    – Hugo
    Sep 21 at 12:53
  • 1
    @Hugo: if the link is long-lived it could be exposed in log files, browser history, explicitly shared with others ... . This is then basically not about a short redirect but having the unique URL as the only protection for a resource. There are question here about this case - like this. Sep 21 at 13:19
  • ah thanks! that was my question I'll mark it as duplicate
    – Hugo
    Sep 21 at 18:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.