Search code examples
restsecurityuuid

Security vulnerabilities when using version 4 UUID as a path parameter

We are working on REST APIs where one of the path parameter is user uuid in version 4. Can this account for Information exposure through query strings in url vulnerability as described at https://www.owasp.org/index.php/Information_exposure_through_query_strings_in_url ?

I read in few blogs that version 4 UUID are safe as far as security vulnerabilities are concerned.

Can someone throw some light on the above understanding?

Solution

  • Version 4 UUIDs are random. They do not contain any information about the system. As long as randomness is taken from a good source, they are safe.