Be Careful with UUID or GUID as Primary Keys
Yes, internal-use integer PKs are a really good idea, but difficult to scale to user-facing sites securely.<p>Often though, you need an automatic, user-friendly unique id for PK's to give users besides asking the user or generating a text slug.<p>Here's one construction:<p>friendly id = HMAC-SHA256(plaintext = "#{table-object-or-model}#{primary-key}", nonce = app-wide-unique-secret-token)<p>Then in the server app, keep a limited MRU cache (Hash table) of digests back to PKs.<p>Out-of-scope: authentication, authorization, CSRF/XSS and replay attacks.