2

Within my ASP.Net MVC application I want to allow a particular user group access to a page where they can download a file. Normally I would request that this user group access the page with the download through a login (username and password) and authenticating their login credentials. However, this user group are complaining about the amount of login details they have for several other web systems and don't really want to have another set of login details to remember. Therefore, I was thinking of passing the user a URL that contains a GUID hoping that this would mean it very unlikely for anyone to guess. For example:

http://www.example.com/admin/93017B0C-D548-40CA-A7B0-D4DA707ABE4C

I would really appreciate what people think of this approach? Would it still be deemed as secure? Or should I go with my normal approach of authenticating user login details and then redirecting them to the secure page with the download.

Thanks in advance.

1 Answer 1

2

See this answer and the GUID RFC for information regarding the security of GUIDs themselves.

Do not assume that UUIDs are hard to guess; they should not be used
as security capabilities (identifiers whose mere possession grants
access), for example. A predictable random number source will
exacerbate the situation.

That is, GUIDs are unique, but they are not unpredictable, making them unsuitable for this use. Use a CSPRNG to generate a 128 bit random token instead.

Regarding the security of URLs, is that URLs are not considered secure. The reason is that they are logged by proxies and servers by default, are held in browser history logs, and can be leaked by the referrer HTTP header.

Also, https is recommended to ensure that the path cannot be intercepted in transit.

Imagine that a user is removed from the group, but you are using this scheme instead of proper authentication. Their browser auto-complete will remember the GUID in the URL, meaning they can access the page any time they want in future (or they could even bookmark it to ensure this).

My recommendation is to use real authentication, and encourage your users to use a password manager.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.