Search code examples
mongodbsecurityuserid

Using custom userId vs Mongo Object_Id

(just started coding a year ago and am still in awe of how cool people on StackOverflow are :))

Anyhow, on my previous job we used custom UUID's for userId's in the backend instead of the automatically generated mongo Object ID's.

Back then I though it had to do with possible security issues when exposing these via URL routes. Yet I can't really figure out how that is any less secure then exposing the custom ID's. Hackers can assume my db?

Could anyone shed some light on best practices in this regard?

Thanks!

Solution

  • ObjectIds are not in any way less secure than, say, UUID.

    They do carry a timestamp part, so if you expose the object id, clients can know the time of generation of this id. But:

    1. This assumes that you use the default generation scheme. Some implementations generate completely random object ids (and so the timestamp value is fake)
    2. I can't think of a way how malicious client can use this for anything.