Be Careful with UUID or GUID as Primary Keys
Yes, internal-use integer PKs are a really good idea, but difficult to scale to user-facing sites securely.Often though, you need an automatic, user-friendly unique id for PK's to give users besides asking the user or generating a text slug.Here's one construction:friendly id = HMAC-SHA256(plaintext = "#{table-object-or-model}#{primary-key}", nonce = app-wide-unique-secret-token)Then in the server app, keep a limited MRU cache (Hash table) of digests back to PKs.Out-of-scope: authentication, authorization, CSRF/XSS and replay attacks.