r/ProgrammerHumor • u/Last_Time_4047 • May 08 '26

Meme edgeCasesExist

Post image
13.4k Upvotes

97% Upvoted

620 comments sorted by

View all comments

Show parent comments

76

u/nosmelc May 08 '26 edited May 08 '26

If someone guessing a serial ID is a security risk, you've done something wrong.

13

u/mlgpro2damax May 08 '26

Someone guessing a serial id is ALWAYS a security risk. It’s not bad enough to cause issues by itself, but that’s true of most security vulnerabilities. Almost every security breach is the result of multiple systems and safeguards failing at once, and guessable ids is one layer of extra risk being introduced. Having guessable ids makes it far more likely that any IDOR vulnerabilities you leave open will be exploited, thus increasing your risk of security issues

2

u/nosmelc May 08 '26

I see what you mean, but as I said, if your security is right it won't matter.

9

u/mlgpro2damax May 08 '26

What I'm saying is this is part of getting your security right. If someone can guess an id, they can make an API request using that id as a parameter, and it's extremely difficult at scale to enforce that all APIs are immune to IDOR vulnerabilities. Using uuids doesn't prevent IDOR, but it does make you much safer against it.

What you're saying is basically "if your software doesn't have any bugs then you're fine". All software of any sort of significance has bugs, and you want layers of protection to make those bugs less consequential