Why is it unsafe to show the user ID in the URL, and how can I replace it?

Question

Backend

Actually the essence of the question is this. There is, for example, a link to the user profile site.com/user/123, where 123 is the id in the database. Why is it unsafe to do so, and what identifier can be used instead of id-shnik ?

Answer 1

this facilitates attacks using mass assignment, as a friend recently unsubscribed , you can either replace it with a unique nickname (and then it also looks beautiful), or think about protection against attacks in advance.

Answer 2

Just give users id out of order.
Generation of 1 million tickets with random unique IDs

Answer 3

Use a hash of a unique name + salt or UUID - they will last a long time

Answer 4

There is such a thing that it is not recommended to show real id on the client. In this case, another field is added, most often guid, and if some identifier needs to be shown on the client, then it is shown.

Answer 5

Example. vk.com. They shine the user id. And at the dawn of existence, it was possible to take this id to see a photo of any user.
It is important to use these ids thoughtfully.

Answer 6

If you use this parameter in GET requests, cast it to int during processing to avoid a number of SQL injections.