在请求和响应中使用行ID设计api

Question

is it a good practice to give row ids in api response and using row ids in api request queries.

whether to use uniquely generated key instead of row ids for api.

Are there any security issues in using row ids

Answer 1

It is commonplace for returned entities to have a unique identifier attached to them. This is typically, but not always, the same as a unique database identifier. If exposing the unique database id is a security issue, it's almost always because an attacker is able to write SQL to your database. In that case, you're better served patching the SQL vulnerability, since the attacker can trivially get unique ids in that case anyway.

There is a good argument for using non-linear ids, as it prevents an attacker from walking through all your data looking for parts of the API you forgot to secure.