Answers.Body: <p>If I can go through the various numbers and pull up any information on any contact, yes, that is a security risk. Typically civicrm will tokenize each contact ID. Or you should have  the views setup that it will only display information if the logged in contact is a match.</p>
  <p>For example, when viewing a public email in browser,</p>
  <p>wordpress civi url: <a href="https://example.org/civicrm/?civiwp=CiviCRM&amp;q=civicrm%2Fmailing%2Fview&amp;reset=1&amp;id=382&amp;cid=2&amp;cs=tokentoekntoekentokeeen" rel="nofollow noreferrer">https://example.org/civicrm/?civiwp=CiviCRM&amp;q=civicrm%2Fmailing%2Fview&amp;reset=1&amp;id=382&amp;cid=2&amp;cs=tokentoekntoekentokeeen</a></p>
  <p>If you remove the bit after cs=, no contact information will be displayed. If the contact id is not a match for the token, no contact information will be displayed.</p>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2023-07-28T20:09:26.633Z
Answers.Text: I thought the question was more 'if we let the world know that a cid exists then bad folk could use that to access other info that should not be public'. My presumption is that displaying the cid in the url adds no greater risk in 'general' than someone just guessing that numbers are used in a CRM to identify contacts (other than the fact that they now know both the ID and the Org name).
Answers.UserDisplayName: petednz - fuzion
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2023-08-01T13:57:54.307Z
Answers.Text: Thanks for the inputs. My question led me down a bit of a rabbit hole of views. My key takeout is that displaying the cid in the url is not a risk because our Views pages are only exposing information my client is happy to make public; and there are stringent protections in place to prevent non-public information being accessed. One commenter suggested that while not a data security risk it can be a business intelligence risk as it exposes data size and velocity (this is not a concern for us).
Answers.UserDisplayName: Davy Ivins
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2023-07-28T15:19:47.497Z
Answers.LastActivityDate: 2023-07-28T15:19:47.497Z
Answers.UserDisplayName: themak
Body: <p>Our Drupal7 site has public customer profile pages created by Views, that are reached via a url that includes the CiviCRM contact ID - ie <a href="https://site.com/profile/CID" rel="nofollow noreferrer">https://site.com/profile/CID</a></p>
  <p>The pages include company information that is generally publicly available. A client has voiced concern that this <em>&quot;is a security issues and opens the door to perform database enumeration etc&quot;</em>.</p>
  <p>We can change the URL to use the customer name rather than the CID but I'm interested if our current practice is a real risk that we should be concerned about?</p>
  
Tags: <security>
Title: Is using CID in a public URL a security risk?
ThreadText: # Is using CID in a public URL a security risk?
  
  (Asked by: username_0 on 2023-07-28)
  
  Our Drupal7 site has public customer profile pages created by Views, that are reached via a url that includes the CiviCRM contact ID - ie <https://site.com/profile/CID>
  
  The pages include company information that is generally publicly available. A client has voiced concern that this *"is a security issues and opens the door to perform database enumeration etc"*.
  
  We can change the URL to use the customer name rather than the CID but I'm interested if our current practice is a real risk that we should be concerned about?
  
  **Tags:** security
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2023-07-28. Score: 0
  
  If I can go through the various numbers and pull up any information on any contact, yes, that is a security risk. Typically civicrm will tokenize each contact ID. Or you should have the views setup that it will only display information if the logged in contact is a match.
  
  For example, when viewing a public email in browser,
  
  wordpress civi url: <https://example.org/civicrm/?civiwp=CiviCRM&q=civicrm%2Fmailing%2Fview&reset=1&id=382&cid=2&cs=tokentoekntoekentokeeen>
  
  If you remove the bit after cs=, no contact information will be displayed. If the contact id is not a match for the token, no contact information will be displayed.
  
  > **Comments:**
  > **username_2**: I thought the question was more 'if we let the world know that a cid exists then bad folk could use that to access other info that should not be public'. My presumption is that displaying the cid in the url adds no greater risk in 'general' than someone just guessing that numbers are used in a CRM to identify contacts (other than the fact that they now know both the ID and the Org name).  
  > **username_0**: Thanks for the inputs. My question led me down a bit of a rabbit hole of views. My key takeout is that displaying the cid in the url is not a risk because our Views pages are only exposing information my client is happy to make public; and there are stringent protections in place to prevent non-public information being accessed. One commenter suggested that while not a data security risk it can be a business intelligence risk as it exposes data size and velocity (this is not a concern for us).  
  
  ---
  
  