使用 GUID 的一部分作为 ID
我正在开发 ASP .Net MVC 应用程序。我的操作之一需要 id 作为参数。例如：
public actionresult Detail(Guid id){
return View();
}
如您所见，我使用的是 Guid 而不是 Int。这个问题更具装饰性。 URL 可以很长，例如 localhost/Detail/0c157b42-379d-41d5-b9ba-83e9df9985b2。
只使用 Guid 的一部分（例如 localhost/Detail/0c157b42）是否安全？
I'm developing an ASP .Net MVC application. One of my actions requires id as a parameter. For example:
public actionresult Detail(Guid id){
return View();
}
As you can see, I'm using Guid instead of Int. The issue is more cosmetic. The url can be very long, such as localhost/Detail/0c157b42-379d-41d5-b9ba-83e9df9985b2.
Is it safe to take only parts of the Guid like localhost/Detail/0c157b42?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（6）
GUID 的设计方式旨在使其具有唯一性，但它的任何部分都不是唯一的。有关详细信息，请参阅此博文。如果您需要缩短 GUID，请对其进行良好的哈希处理 - 例如 SHA-1 或（如果您没有安全问题）MD5。
GUID is designed in such a way that it is intended to be unique, but any part of it is not. See this blog post for details. If you need to shorten the GUID take a good hash of it - like SHA-1 or (if you don't have security concerns) MD5.
不，这不安全。
不过，您可以计算它的 SHA-2 哈希值，并获取其中的前几个字符。
No, it's not safe.
You can calculate a SHA-2 hash of it though, and take the first few characters of that.
不，您需要整个 GUID，因为子集可能不唯一。
例如：
请注意，只有最后一个数字不同。两者的起点是相同的。您也不能使用 GUID 的尾部，因为无法预测 GUID 创建时的哪一部分将发生更改。
No, you need the entire GUID since there is a possibility that a subset may not be unique.
For example:
Notice, only the last number is different. The beginnings are both the same. You can't use the trailing end of the GUID either since there's no way to predict what part of the GUID will change when its created.
需要考虑的其他一些选择 -
* 如果有多个 GUID 以 0c157b42 开头的详细信息，请使用 URL localhost/Detail/0c157b42 显示适用的详细信息对象的列表。
* URL 别名 - 允许在详细信息对象上使用“友好 URL”字段。
Some other options to consider-
* If there are more than one Details with GUIDs starting with 0c157b42, have the URL localhost/Detail/0c157b42 show a list of applicable Details objects.
* URL aliasing - allow for a "Friendly URL" field on the Details object.
您可以清除 -s 的 GUID 并将十六进制转换为 Base32 (AZ,0-5)，这会将其缩短为 16 个字符。
You can clean the GUID of -s and convert the HEX to Base32 (A-Z,0-5) which will shorten it to 16 characters.
回复有点晚，但万一有人读到此内容...
根据用途，您可以提供缩短的 GUID 值。
例如，如果生成 ID 值并将其作为身份验证令牌类型的值提供给用户，那么在生成过程中您可以只获取任意数量的字符并将其与其他使用中的值进行比较。如果有匹配，则生成一个新的并重新比较，直到其唯一。
如果您也修剪 GUID 的哈希值，那么这种技术也是可取的……只是为了安全起见。事实上，任何时候你随机生成一个值用作 ID 时，你都应该确保它不是“已在使用”
Bit of a late response but in case anyone reads this...
depending on the use, you can provided a shortened GUID value.
for instance, if the ID value is generated and given to the user as an Authentication Token sort of value then during the generation you could just take however many characters and compare it with other in use values. if any matches, then just generate a new one and re-compare until its unique.
This technique is also advisable if you trim a hash value of the GUID too.. just to be safe. In fact any time you randomly generate a value to be used as ID then you should make sure it is not 'already in use'