Tingg

Avoid exposing your private object references to users whenever possible, such as primary keys or filenames.As a system, I want to avoid exposing internal object identifiers in URLs to prevent enumeration attacks.

By exposing the primary key (123) directly in the URL, anyone who sees or obtains this URL gains insight into the application's database structure. This information leakage can be exploited by attackers to gather intelligence about the system and potentially target specific user accounts or data. Attackers can perform enumeration attacks by manipulating the primary key values in URLs.