1

I'm building a note-taking app, when a user writes a note an id is generated and I redirect them to a page where they can see its content with a URL like /note/DXSt832pS5iLuos6uxBn. What are the security risks of not double-checking that the user has access to this page, and simply trusting that if they know the id they're authorized?

The id is an autogenerated id from firestore. I found this answer speaking about how it should be as unique as a guid and crypo quality random.

Improve this question
2

1 Answer 1

Reset to default
1

Properly done the risk of using such a unique link without additional authentication is low. Properly done means that

  • Only authenticated users are redirected using such a link and only to resources they should be able to access
  • Since the link is intended for the redirect only it should be very short lived. This means it should be invalidated after visit (i.e. redirect was successful) and/or after a short time. Thus even if the users shares the link voluntarily or involuntarily (attack) with somebody else, the other person should not be able to access the content
Improve this answer
3
  • Thanks! If the link isn't short live, in my case the guid is the resource id, I assume the risks increase a lot? I assume an attacker or the network admins could see the links?
    – Hugo
    Sep 21, 2022 at 12:53
  • 1
    @Hugo: if the link is long-lived it could be exposed in log files, browser history, explicitly shared with others ... . This is then basically not about a short redirect but having the unique URL as the only protection for a resource. There are question here about this case - like this.
    – Steffen Ullrich
    Sep 21, 2022 at 13:19
  • ah thanks! that was my question I'll mark it as duplicate
    – Hugo
    Sep 21, 2022 at 18:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .