Salesforce Id Iteration Attacks
Please stop using Salesforce Ids in URLs or other user accessible parts of your solution. Why not use Salesforce Ids on public web sites? I run into this question from time to time and figured some more public commentary would be useful. The super short version: they are not a security or access control mechanism. During a recent Salesforce Open Source Commons sprint a question came up about why it’s important to use a random value, instead of a Salesforce Id, in public facing use cases. We were talking about the Unsubscribe Link package, and it makes a good use case for discussion. ...