title: Implementing secure, unique "single-use" activation URLs in ASP.NET (C#)
body: <p>I have a scenario inwhich users of a site I am building need the ability to enter some basic information into a webform without having to logon.  The site is being developed with ASP.NET/C# and is using MSSQL 2005 for its relational data.</p>
  
  <p>The users will be sent an email from the site, providing them a unique link to enter the specific information they are required.  The email will be very similar to the style of email we all get when registering for sites such as forums, containing a randomly generated, unique URL paramter specifically pertaining to a single purpose (such as verifying an email address for a forum).</p>
  
  <p>My queries are regarding the secure implementation of this problem.  I was considering using a GUID as the unique identifier, but am unsure of its implications in the security world.</p>
  
  <ol>
  <li>Is a GUID sufficiently long enough such that values cannot be easily guessed (or brute-forced over time)?</li>
  <li><p>Is .NET's GUID implmentation sufficiently random in the sense that there is an equal chance of generation of all possible values in the "key space"?</p></li>
  <li><p>If using a GUID is an acceptable approach, should the site then redirect to the information via URL rewriting or by associating the information in a datatable with the GUID as a reference?</p></li>
  <li><p>Will using a URL rewriting hide the true source of the data?</p></li>
  <li><p>Should I consider using TSQL's SELECT NEWID() as the GUID generator over the .NET implementation?</p></li>
  <li><p>Am I completely wrong with my approach to this problem?</p></li>
  </ol>
  
  <p>Many thanks,</p>
  
  <p>Carl</p>