API Design · Senior · Question 49 of 75
Why should an API avoid sequential, guessable identifiers for sensitive resources even with authorization in place?
- 1Authorization doesn't work with numbers
- ✓Correct answer: Defense in depth: guessable IDs make enumeration easy if an authorization bug slips in, and they leak business volumes
- 3Sequential IDs can't be indexed
Explanation
Opaque IDs are an extra layer, never a replacement for authorization.