Question

I’m using an approach but I don’t know if it’s wrong.

When I connect to the database in my website, the ResultSet will return the “Username” and the “UserId”.

while(rset.next()) {
//I place the Username inside a DIV, which is visible
//I Place the UserId inside another Div, which is not visible
}

I place the UserId because I need to grab them later for jquery and Ajax requests, when I view the source code, those UserIds are visible in the source code.

Means anyone can know the id of the listed users, or any other thing that has an id, does this weaken the website’s security?

Answer 1

As long as that information doesn’t help an attacker to get:

1. Access to your server/database
2. Access to a different user’s account
3. Sensitive information about your users

Then it is okay to put it “publicly”. For example, here on Stack Overflow, my user ID is 871050, it won’t help you achieve either of the goals listed above, so it’s fine for you to see it.