search

doubtfire-lms / doubtfire-api

Rails RESTful API for the Doubtfire back-end
GNU Affero General Public License v3.0
29 stars 334 forks source link

Implement hashids to obfuscate ids #369

Open jakerenzella opened 2 years ago

jakerenzella commented 2 years ago

Currently all ids are sequential, which could lead to potential vectors for attack. Sequential ids are indexible however, which give database performance boosts.

Implementing Hashids should give us the best of both worlds: https://hashids.org/ruby/

jakerenzella commented 2 years ago

@macite library looks good, let me know what you think

macite commented 2 years ago

Sounds like a good idea. Where are you thinking of using this?

jakerenzella commented 2 years ago

Everywhere a publicly accessible sequential ID is returned to the front end - Probably start with users as most important? Or projects.

sneaky-patriki commented 2 years ago

I can take this up :)

sneaky-patriki commented 2 years ago

@macite Which areas of the code are the hashids best to be used in?

macite commented 2 years ago

I'd start with users...

macite commented 2 years ago

and user administration

sneaky-patriki commented 2 years ago

Sounds good 👍 Just to confirm that's all the endpoints in the users_api and units_api .rb files?