html - 在 HTML ID 中使用数据库主键

Question

只是想问问。

我有一个站点，其中每个用户都链接到数据库中的一个 ID，并且这个主键包含在许多表中。我获取用户信息的最快方法是拥有此 ID。

将此 ID 放入网站 HTML 代码中会被视为不良做法吗？例如 id="theIDnumber"

否则我可以只使用用户名，然后在数据库中为这个 ID 引用它 - 这很好，但我相信使用 ID 会更快。

想法？

Answer 1

如果您的 key 可预测，我会说不。一个简单的例子:如果您使用顺序递增的主键，用户可以从数据中提取可能涉及隐私问题的信息。例如他们可以推断出哪个帐户是在他们的帐户之前创建的。对于那些试图系统地从您的网站窃取信息的人来说，生活也变得容易了。

一些相关阅读

1. https://stackoverflow.com/a/7452072/781695
   

   You give your end users the opportunity to mess with those variables and pass any data that they like. The counter measure to mitigate this vulnerability is to create indirect object references instead. This may sound like a big change, but it does not necessarily have to be. You don't have to go and rekey all your tables or anything, you can do it just by being clever with your data through the use of an indirect reference map.
   

2. https://security.stackexchange.com/a/33524/37949

   Hiding database keys isn't exactly required, but it does make life more difficult if an attacker is trying to reference internal IDs in an attack. Direct references to file names and other such internal identifiers can allow attackers to map the internal structure of the server, which might be useful in other attacks. This also invites path injection and directory traversal problems.

3. https://www.owasp.org/index.php/Insecure_Direct_Object_Reference_Prevention_Cheat_Sheet

   An object reference map is first populated with a list of authorized values which are temporarily stored in the session. When the user requests a field (ex: color=654321), the application does a lookup in this map from the session to determine the appropriate column name. If the value does not exist in this limited map, the user is not authorized. Reference maps should not be global (i.e. include every possible value), they are temporary maps/dictionaries that are only ever populated with authorized values.