I have a moderate understanding of the innards of RequestFactory, but now I'm implementing a security policy around it and I don't see much literature on this topic. I'm particularly interested in the security of the client-side proxy id's that RequestFactory is using. For example, an object's id in my database might be 32, but RequestFactory might refer to the id as Qkjnsd89urknasj3 or something.
How hard is it for someone to generate a valid id of one of my objects from thin air? How are these ids generated?
Any info is appreciated, thanks.
They are not secure, they are base64 encoded. This is to make sure that no matter what kind of data you use in your key, it can turn it into and out of a real key.
So don't allow free and open access to objects based solely on the ID of an instance, but have some kind of logic that checks that the current user is allowed to look at a record. Or make the IDs non-predictable, and the ID space large enough that random guessing will get you nowhere. But even then, the keys will be base64 encoded when RF refers to them.