Urgent.News

What's breaking now, across thousands of outlets.

More in Finance & Markets

arxid: keyed, non-enumerable ID obfuscation with a measured ARX-Feistel permutation

If your API exposes /users/1042 , someone can request /users/1043 . And /users/1044 . Sequential integer IDs leak two things you probably didn't mean to leak: roughly how many records you have, and a…

  • arxid library obfuscates sequential integer IDs securely
  • Uses keyed, reversible ARX-Feistel permutation with 40-bit domain
  • Four rounds provide sufficient non-enumerability

More from Monday 3 August →