This is a good post, but first a word of caution.<p>Many people, when faced with &quot;unwanted information disclosure&quot; via ID enumeration, will look to encryption to solve this problem. Please don&#x27;t; it&#x27;s the wrong tool for the job.<p><a href="https:&#x2F;&#x2F;paragonie.com&#x2F;blog&#x2F;2015&#x2F;09&#x2F;comprehensive-guide-url-parameter-encryption-in-php" rel="nofollow">https:&#x2F;&#x2F;paragonie.com&#x2F;blog&#x2F;2015&#x2F;09&#x2F;comprehensive-guide-url-p...</a><p>Use a random lookup instead of encryption. (You&#x27;ll notice that <a href="https:&#x2F;&#x2F;paragonie.com&#x2F;b&#x2F;oMFJhGJ0aSgCaZq0" rel="nofollow">https:&#x2F;&#x2F;paragonie.com&#x2F;b&#x2F;oMFJhGJ0aSgCaZq0</a> takes you to the same URL.)<p>Use application logic (and <i>access controls</i>) instead of random lookups, where it makes sense to do so.<p>If you absolutely <i>must</i> use encryption (i.e. you don&#x27;t have a place to store state), make sure you use an AEAD mode.<p><a href="https:&#x2F;&#x2F;gist.github.com&#x2F;tqbf&#x2F;be58d2d39690c3b366ad" rel="nofollow">https:&#x2F;&#x2F;gist.github.com&#x2F;tqbf&#x2F;be58d2d39690c3b366ad</a>