I work for a firm that has a marketplace on the web. We want to make a link with a token that stops an ad on the marketplace without the user being logged in.
Someone suggested that we make a token from this: base64urlencode(md5("salt-adid"))
- adid is information known by the user.
- salt is just a secret word.
Given this is this solution secure? The user can know the adid.
Will it be possible for a malicious user to calculate the url for stopping an ad?
How can this be change to be more secure?
EDIT: Xander pointed out that something was unclear and I will try and elaborate.
"It's not clear to me why you need a token at all. Is this just for some logged out users rather than all logged out users?"
It should not be possible for any user to stop the ad just to owner. We will be sending the url to the owner so he/she can use it if they want to stop the ad. So it is just for some logged out users.