Add "help avoid sending teenagers to prison" to the list of reasons why you should prefer UUIDs over integers in your Internet-facing REST API.
This API was supposed to be private and yet supported trivial enumeration?
This API was supposed to be private and yet supported trivial enumeration?
If you know the hash, you likely already know the file.
Cryptographic hashes aren't random by nature.
Edit: even if they aren't PDFs, you can feed the content to the hash function.
With a hash it’s more expensive to compute the ID, but you get advantages such as content-addressability, data integrity without trust, and easily mergeable databases. It’s a good amount of bang for not much more buck.
At the cost of leaking more metadata in the ID, by including a checksum/namespace, you can recognise a valid ID or determine the type of object it refers to without fetching anything from storage, mitigating some DOS attacks.
IDs are a subtle thing, and in my experience, often overlooked as a design issue. A lot of times it ends up as something like “id integer primary key autoincrement” without any thought.
Relying ONLY on obscurity is a failure.
EDIT: I'm mostly kidding.
uuidv4