Contents
Why do we use UUID?
UUIDs are generally used for identifying information that needs to be unique within a system or network thereof. Their uniqueness and low probability in being repeated makes them useful for being associative keys in databases and identifiers for physical hardware within an organization.
What can someone do with a UUID?
Universally Unique IDentifiers, also known as UUIDs or GUIDs, are 128-bit numbers used to uniquely identify information in computer systems. UUIDs can be used to refer a wide variety of elements (documents, objects, sessions, tokens, entities, and so on). They can also be used as database keys.
Why you should use UUID?
The point of a UUID is to have a universally unique identifier. There’s generally two reason to use UUIDs: You do not want a database (or some other authority) to centrally control the identity of records. There’s a chance that multiple components may independently generate a non-unique identifier.
Can a UUID be guessed?
Don’t rely on UUIDs for security. Never use UUIDs for things like session identifiers. The standard itself warns implementors to “not assume that UUIDs are hard to guess; they should not be used as security capabilities (identifiers whose mere possession grants access, for example).”
Why is an UUID better than a traditional ID?
Of course, the question Why is an UUID safer/better than an traditional ID came by. The UUID is supposed to be used in a Database table of Users, containing login, but also personal information like phone number, real name, address etc.
Can a clustering key be used as a UUID?
There is also an issue with the clustering key on the table being a UUID – check the accepted answer on this question for a good explanation. https://stackoverflow.com/questions/11938044/what-are-the-best-practices-for-using-a-guid-as-a-primary-key-specifically-rega A UUID will not add any specific security when used as an ID in a database.
How does an UUID add security to a database?
A UUID will not add any specific security when used as an ID in a database. Its main role is to be (reasonably) unique. Basing the security of a database on the randomness of IDs (supposedly because they are harder to guess than an incremental ID, I guess) is not a good security measure.
Can a UUID be treated as a string?
A naive use of a UUID, which might look like 70E2E8DE-500E-4630-B3CB-166131D35C21, would be to treat as a string, e.g. varchar (36) — don’t do that!! “Oh, pshaw”, you say, “no one would ever do such a thing.” Think twice — in two cases of very large databases I have inherited at relatively large companies, this was exactly the implementation.