CODEWITHSUNDEEP
sql-serverasp.net-mvc
Adam Benson
Adam Benson

Reputation: 8532

Is using an int as a primary key a security risk?

I have read a lot of articles on the "int vs GUID for primary key" question and can see that if you use a sequential GUID you don't need to worry about performance too much.

The reason my boss wants to use GUIDs is that he feels it's more secure. We encrypt all parameters into an MVC call so I'm not sure I see the issue but his main argument is that, armed with one key (assuming they can break the encryption), then it's easy to guess the next key. You can't do this with a GUID, even with pseudo-sequential GUIDs such as COMBs (http://csharptest.net/1250/why-guid-primary-keys-are-a-databases-worst-nightmare/).

But is using an int really that insecure? (We encrypt with Triple DES.) Is there any mileage in making int64 primary keys "almost sequential" - i.e. they always go up but leave gaps in the sequence?

If anyone has any observations about the security side of this I'd be grateful.

Upvotes: 2

Views: 1202

Answers (3)

RaniDevpr
RaniDevpr

Reputation: 410

you could use both, int for internal use (if you are worrying about performance) and GUID for external (for example in web urls of your web services), you may also benefit from GUID if you have cross site objects (for example items across several stores that transfer in between them), guid could serve as a global identifier.

Upvotes: 1

Carra
Carra

Reputation: 17964

If a user wants to access resource "1" or "2" you have to check if he has permission to access it. This would be the same if you use Guid "A" or "B".

Upvotes: 1

jgauffin
jgauffin

Reputation: 101150

Key security is about preventing users from be able to access someone elses items. If you use ints in an url you can simply replace your id with a near one. For instance if your url is http://mysite/someresource/1/ you could replace it with http://mysite/someresource/2/.

With GUIDs that is a lot harder since it takes a magnitude more attempts to find another id. However, it's like lotto. You can be lucky. Thus it's still not secure.

The only secure way is to each time check if the user is authorized to access the requested resource or not.

I do not know why you encrypt the parameters? If it's to limit access it's not very secure. Someone could still just pass it on to someone else (copy/paste) and that other person can access it. Social engineering.

Upvotes: 4

Related Questions