Question

I want to create a public profile page for every user on my website. Something very similar to SO user profiles. But I don’t want to expose Guid I’m using as PK. Neither I know how unique will be a user name over the lifetime of the website to use it in url.

The question is how SO itself is doing this in url https://stackoverflow.com/users/242506/nubm ? The user name can be removed and the url still works but should I generate some publicly viewable UserId next to my Guid that I can use in links to the profile page and display it in urls?

I’ve found similar questions Should I expose a user ID to public? or How do I create a "public" user profile page in ASP.NET (3.5) but they are not exactly what I want to know.

Answer 1

You can do two things.

First you can create an extra incremental ID on the database, either on the ASP.NET tables or a new map table, and give a smaller number connected to the Guid. Why a smaller number? Because a Guid is 128 bits and is too big to be used as it is on the url.

Then, you can use this smaller number, which is connected with the Guid, on the url. The only exploit issue here is that anyone can find all the list of your users. SO have this public so is not an issue if you have them also public. SO use the number in their URL for finding the user and the user name is for better SEO. The number stays the same but the name can change, so only the number is used to locate the user.

The second solution is to compress and encode the 128 bit Guid number to a 73 base character string. I chose a 73 base character because 73 is the permitted un-escape characters on the url.

Here are some examples that I found for make this converting:

http://www.singular.co.nz/blog/archive/2007/12/20/shortguid-a-shorter-and-url-friendly-guid-in-c-sharp.aspx

http://jopinblog.wordpress.com/2009/02/04/a-shorter-friendlier-guiduuid-in-net/

http://buildmaestro.wordpress.com/2011/04/27/installscript-to-transform-guid-into-compressed-guid/

a simple convert to base64 (from Dave Transoms)

public static string Encode(Guid guid)
{
  string encoded = Convert.ToBase64String(guid.ToByteArray());
  encoded = encoded
    .Replace("/", "_")
    .Replace("+", "-");
  return encoded.Substring(0, 22);
}

public static Guid Decode(string value)
{
  value = value
    .Replace("_", "/")
    .Replace("-", "+");
  byte[] buffer = Convert.FromBase64String(value + "==");
  return new Guid(buffer);
}