URL参数的最佳实践[关闭]

Question

How much important is it to secure the URL parameters naming? Is ?user_id=3 less secure then ?uid=3 or ?u=3 or just /user/3? Should I really consider making parameters hard to guess?

Answer 1

Obscurity is no security at all. The only reasonable factors to consider are readability/prettiness of links. If you have 200-character links, they are not memorable, and are kind of hard to paste, and consume a lot of space (e.g. can't send through SMS, and they're hard to type on a mobile); on the other hand, it's easier to have confidence in a link if you can understand its semantics.