DEV Community

Discussion on: RESTful Security: Plug the Leaks!

Collapse
 
sokolovdenis profile image
Denis Sokolov

If there is no authentication in API, and we want to protect our growth rate statistics - yes, same problem exists. And GUID instead of INT identifiers may help.

Thread Thread
 
sqlrob profile image
Robert Myers

Even if there is authentication in API, it doesn't matter. (See Panera's "fix")

GUID or other unpredictable identifier is the only real fix. Rate limiting each user can help as well, but how useful that is really depends on how hard it is to get authentication tokens.