Code Smell 120 - Sequential IDs

Photo by Max Bender on Unsplash

Code Smell 120 - Sequential IDs

Most IDS are code smells. Sequential IDs are also a vulnerability

Maxi Contieri
·Mar 10, 2022·

2 min read

Subscribe to my newsletter and never miss my upcoming articles

Play this article

Table of contents

  • Problems
  • Solutions
  • Context
  • Sample Code
  • Detection
  • Tags
  • Conclusion
  • More Info
  • Credits

TL;DR: Don't expose obvious consecutive IDs.

Problems

Solutions

  1. Use non-obvious keys.

  2. Use dark keys or UUIDs.

Context

IDs are a problem when dealing with domain objects.

IDs do not exist in the real-world so, they break our bijection.

We should only use IDs when exposing internal resources to the outer world beyond system boundaries.

These are always accidental problems and should not interfere with our models.

Sample Code

Wrong

class Book {
    private Long bookId; //book knows its ID
    private List<Long> authorIds; // book knows author IDs
}

Book harryPotter = new Book(1, {1, 2, 3});
Book cleanCode = new Book(2, {4});
Book donQuixote = new Book(3, {5});

//We can scrap from now on.

Right

class Author {    
    //.. Author protocol
}

class Book {    
    private List<Author> authors; // book knows authors
    // No strange behavior. just what a book can do
    // Real books don't know about IDs
    // ISBN is accidental to a book. Readers don't care
}

class BookResource {    
    private Book resource; // The resource knows the underlying book
    private id; //The id is the link we provide to external world
}

Book harryPotter = new Book({new Author('J. K. Rowling'));
Book cleanCode = new Book({'Robert Martin'})
Book donQuixote = new Book({'Miguel Cervantes'});

BookResource harryPotterResource = new BookResource(harryPotter, UUID.randomUUID());                             

//Books don't know they id. Just the resource does

Detection

[X] Automatic

We can use Pentesting techniques against our system to detect this smell.

Tags

  • Security

Conclusion

In case we need to expose internal objects to the external world, we should use non-obvious IDs.

In this way, we can detect (and block) brute force attacks monitoring the traffic and 404 errors.

More Info

Credits

Photo by Max Bender on Unsplash


The only truly secure system is one that is powered off, cast in a block of concrete and sealed in a lead-lined room with armed guards.

Gene Spafford


This article is part of the CodeSmell Series.

 
Share this

Impressum

Technical Opinions are my own. I don't have the revealed truth.

Software Design is a creative activity. These are hints and not rigid rules.

I write on BackEnd Business Systems and OOP Design. My advice/experience might not suit other systems.

You can write me at info(at)maximilianocontieri.com