C# mongodb ObjectId useage risks

Question

I was watching on Mongodb ObjectId object. It seems to be non-safe object to expose to my client (even its his own SessionId). Though im using the following code to generate random ObjectIds:

var timestamp = DateTime.UtcNow;
        var machine = _random.Next(10000, 75757575);
        var pid = (short)_random.Next(10000, 75757575);
        var increment = _random.Next(10000, 75757575);

        return new ObjectId(timestamp, machine, pid, increment);

I get sequential ids sometimes and I dont want the user to be able to guess 1 million ids and finally catches a real one.

Is there any way to still use mongodb on c# and maintain a secure id? Now, some say "use https", but that's not the issue. Someone can log into the web, get a sessionId of type ObjectId and try to guess.

How can I reduce the likelyhood of something like that to happen?

Answer 1

如果数据库中存储了任何敏感信息，则应在应用程序中应用一些ACL规则，以决定用户是否可以通过objectId检索数据。