CyberCertPrepWeb App FundamentalsAPIs & RESTEASYFree question
An API developer uses UUIDs (v4) as resource identifiers instead of sequential integers. A colleague argues this is unnecessary since both are validated by the server. What is the actual security benefit of UUIDs?
- A.UUIDs are encrypted by the database and provide confidentiality
- B.UUIDs are not enumerable: an attacker cannot iterate through sequential integers to discover resource IDs (IDOR enumeration). Even if UUIDs are exposed in URLs, their 122 bits of randomness makes guessing other users' resource IDs computationally infeasible - forcing attackers to rely on logic flaws rather than simple enumeration
- C.UUIDs are longer and therefore more secure by design
- D.Sequential integers are prohibited by REST API standards
Why B is correct
Sequential IDs are trivially enumerable: knowing your order ID is 1234 reveals that orders 1235, 1236... exist and are likely from other customers. UUID v4 (randomly generated) has 122 bits of randomness - guessing another user's UUID is computationally infeasible. Important caveat: UUIDs do not replace authorization checks - the server must still verify the requesting user can access the identified resource. UUIDs reduce the enumeration attack surface, not the authorization failure risk.
Know someone studying for Web App Fundamentals? Send them this one.