title: Insecure Direct Object References and Search Engines
body: <p>According to <a href="http://www.owasp.org/index.php/Top_10_2010-A4" rel="nofollow">OWASP Top 10 List</a> one way to prevent insecure direct object references is to provide only indirect references. These are artificial references that are mapped to the direct (e.g. DB) references on the server. The mapping is stored in the session.</p>
  
  <p>Unfortunately, this solution is not very search engine friendly. The links stored by the crawler would be invalid in another session.</p>
  
  <p>Is there a way around this problem? Are there other solutions apart from mapping references or checking object access? </p>