title: Exposing database IDs - security risk?
body: <p>I've heard that exposing database IDs (in URLs, for example) is a security risk, but I'm having trouble understanding why.</p>
  
  <p>Any opinions or links on why it's a risk, or why it isn't?</p>
  
  <p>EDIT: of course the access is scoped, e.g. if you can't see resource <code>foo?id=123</code> you'll get an error page. Otherwise the URL itself should be secret.</p>
  
  <p>EDIT: if the URL is secret, it will probably contain a generated token that has a limited lifetime, e.g. valid for 1 hour and can only be used once.</p>
  
  <p>EDIT (months later): my current preferred practice for this is to use UUIDS for IDs and expose them. If I'm using sequential numbers (usually for performance on some DBs) as IDs I like generating a UUID token for each entry as an alternate key, and expose that.</p>