Support Forum

Search user topics feature question

RB rb22
rb22
Member
Member since Apr 2010
39 posts
Oct 16, 2015 · 11:16 am · Edited

On another note, on the sp user profile at the bottom of the screen, I just discovered the view topics by user link, which is very handy, but I am wondering if security would be improved by not exposing the wp user_id. I am thinking about making this more visible to users but before that I thought I would get your take on the security concern.

Might it be better to pass the user_login for the “value” and then have the back end get the user_id?

https://simple-press.com/support-forum/?search=1&new=1&forum=all&value=USER_ID&type=4

 

 

ust a thought

3 Answers

New Answer
YS Yellow Swordfish
Yellow Swordfish
Member
Member since Nov 2008
16,437 posts
Oct 16, 2015 · 11:43 am

On this one then perhaps the question is why would user_login be any more secure than user_id? I don’t see it…?

RB rb22
rb22
Member
Member since Apr 2010
39 posts
Oct 16, 2015 · 12:43 pm

Well generally, I am no expert but I think coders generally try not to expose critical id information … by knowing the id you could use it for hacking, session hijacking etc.  All the tables are cross referenced by id not user_login … so it would be easier to get more info about the user if you knew the id. If the hack allows them to get the user id from the user login, I guess the point is moot  but that’s a big assumption.

You’re right there is less concern about this that I thought but there is a debate. here are some links discussing the issue.

 

http://stackoverflow.com/questions/396164/exposing-database-ids-security-risk

http://programmers.stackexchange.com/questions/139450/is-obscuring-obfuscating-public-facing-database-ids-really-a-best-practice

 

Thanks

YS Yellow Swordfish
Yellow Swordfish
Member
Member since Nov 2008
16,437 posts
Oct 16, 2015 · 12:50 pm

Oh yes – there is a permanent debate always has been. And we have had it both ways in the past and always had complaints no matter which way it is. But WordPress is pretty solid in not allowing information like this to leak or be useful.