title: Security risk of passing a GUID via URL
body: <p>I am after some advice regarding use of GUIDs from the security perspective.  I have developed an ASP.Net application.  It provides the user with access to some material, such as documents and photos, that aren't on the web server.  These are stored on a file server.  I have a 'GetResource.aspx' page which takes the ID of the resource, opens it using System.IO.FileInfo writes it to the response stream and returns it.</p>
  
  <p>So, GetResource.aspx?id=123 would return, say, a picture that the user has access to.  Of course, the user could manually enter the URL as GetResource.aspx?id=456 in which case the picture / document etc with that ID would be returned and it may not be one they have permission to access.</p>
  
  <p>So clearly using an integer ID is not adequate.  Would using a GUID as the ID provide enough 'randomness' that I could reliably assume the user could never manually enter "GetResource.aspx?guid={A guessed guid}" and ever expect to access a valid resource, including if using a script that made many random guesses per second?</p>
  
  <p>Or, is there no substitute to determining the ID of the user from a Session variable, determining he does actually have access to the requested resource and only then returning it (Which as I write this I'm more and more convinced is the case!).</p>
  
  <p>Thanks</p>