Asp.NET MVC Client Application

Question

I develop (and develop) web software that will allow the general public to subscribe to the service, become a client and exchange fairly confidential data.

I am working on documentation and tutorials, and of course the default RESTful template in ASP.NET MVC is to make the url like this: / customer / edit / 3487.

I guess I'm a little squeamish about displaying technical details such as the client ID in the URL bar.

What are smart kids doing these days? RESTful means "put your record id on the display"?

Edit: In ASP.NET WebForm, I would save this in a session, I think. But I believe that this is not recommended in ASP.NET MVC.

Edit: I do not intend to rely on security through obscurity.

This does not mean that it is a good idea to give users any ideas or any information about basic data. Let's say I have an application that publishes information about various cases in the Chamber of Commerce in order to be arbitrary. Once you are logged in, you have the administrative right to click on each business in the directory and view all of them, but the application should burst to send them to you as search results or the like. Just because the user is technically allowed access to all the records, this does not mean that you should be trivial to write a screen scraper that loads all my content in a few minutes. In addition, the user can simply look at the customer ID and guess how many customers I have. There are many good reasons not to show it.

Answer 1

, , .

URL-, .

Answer 2

URL-, , .

, bussinesses , Url. , - :

//View/theouteredge/

, , .

//View/theouteredge/78665/

, .

routes.MapRoute(
  "Bussiness",
  "Business/{Action}/{name}/{zip}/",
  new { controller = "Business", action = "Index", Name = "", PostalCode = "" }
);

[authorize] .

Answer 3

, URL- - . , . , , .

Update:

, URL-. , URL- - , . .

- , . REST (IMO) , . - HTTP GET. : URL- - cookie. cookie .

Answer 4

[authorize], , .

6 1/2 , . .

, .

, , , , ..

Answer 5

, URL-. , . , , , id.

, Guid, , .:)

Answer 6

If you use any other way than the client identifier, simply because you are concerned about security, then you use security through the unknown , which is a bad idea. For proper authorization, you will need something like you: 1) you need to log in with this client ID or 2) log in as an administrator so that this request is successful.