Tags - security

Obfuscating Object IDs in APIs

It's become common wisdom to obfuscate primary key values in API URLs as some sort of "security measure".

This often takes the form of using UUIDv4 or some other randomly generated value for the Primary Key (PK), instead of a simple sequential value.

Other times, an additional surrogte key field is added for this, separate to the existing PK.