Are visible GUIDs a security risk?

Question

Hi, I'm using ASP.NET and the membership provider for my site. If the user is able to easily see their GUID, would that be considered a security risk? Should I take extra steps to prevent users from easily finding their GUID such as when they confirm their verification process. Although there are ways around this, such as using a seperate GUID for 'front-end' activities, is this an unnecessary increase in overheads and development time?

An example of possible spoofing is when I'm authenticating a user's permission to access a resource.

Guid cUser = (Guid)Membership.GetUser().ProviderUserKey; //if this is publicly viewed, then  there's no reason to call the DB or store in a session as it can be placed in the QueryString
bool grantAccess = CheckGroupPermission(cUser, groupID);

Thanks

Answer 1

It is generally not a good idea to expose keys to a database to the outside world, but if you had to choose what kind of field to expose, a GUID is not that bad of a choice. It is much better than exposing a sequence number where it can be guessed (rather easily) what constitute an unknown valid identifier in a DB.

You can, instead of providing the GUID to the outside world, provide the username. It should be unique.

Answer 2

No, displaying the id of the user record is not a security risk in itself. You should not rely on it being secret anyway, as it would be hard to make yourself totally independent of them.

It is however a security risk if you are using only the id as verification to grant access to resources. You can never rely completely on any information sent from the client, you should always use some information that can't be tampered with so easily, like a value in a session variable that is only placed there after proper user verification.