Is exposing the PRIMARY KEY of an entity considered a serious security problem?

Asked

Viewed 65 times

2

Considering a very basic example: suppose there is a web system in which the user can view his profile (and other users) through a unique identifier passed to a route, for example:

https://sistema.io/profiles/<identificador>

Then it was chosen to use the ID field of the entity that contains the data of that user persisted in my BD. So, assuming my system has a João user who had his identifier generated in the record as 100, your profile could be accessed through the following link:

https://sistema.io/profiles/100

My question is: is exposing this type of data (the ID, the table’s primary key) a serious security problem? Here I used the example of the URL, but it could be any example in which the Primary key be exposed to those who are using the application.

I’ve heard a lot that this is serious because of the relationships that the entity may have but I don’t understand how it would cause a security breach in my application without having a clear example.

security-guard primary-key

  • I’ve seen examples like this, but the guys used one How the Global Unique Identifier (GUID)? instead of a sequential id.

  • I believe it is a security flaw, however, in the context of your app, that ID may have numerous meanings in your application. It all depends on how it is used. The stackoverflow itself exposes these Ids > https://answall.com/questions/357895

  • 2

    @Query And why do you think it’s a security breach?

  • @Andersoncarloswoss Because if there is no method to check access or write permissions, an "advanced" user may be able to access all application users by increasing the ID.

1 answer

0

Not, if the server-side actions are not validated, the failure is there, exposing a primary key may be easier, but it is not a failure

As for that facility... As you are talking about primary key, I will consider an application using SQL, where the ID are generated sequentially, that is, in one or two attempts easily finds a database line. Having this column exposed makes it easy to find a specific row. But if there is no validation you probably get the list of all rows of all tables in the database (or at least most)

Browser other questions tagged security-guard primary-key

You are not signed in. Login or sign up in order to post.