The share link next door
Your app lets people share a read-only report with a link. A user changed one digit in theirs and opened a stranger's financial report.
This answers: How do I make share links secure? No coding needed. 2 quick decisions.
- Who may see what
- Keeping data safe
Checking your access…
How do I make share links secure?
A share link works like a password in a URL, so it must be impossible to guess. Never use sequential numbers or short codes; generate a long random token for each shared item. Let owners revoke links and set expiry, because even unguessable links leak through forwarding, browser history and chat previews.
Breaks at Your server: Share links numbered in order
Why AI tools write this bug
AI tools often build share pages on the record's database id, which is usually a counting number, because the page already has it.
How to fix it
- Generate a long random token for each share.
3 more steps, and a prompt that checks your own app for this bug. Part of Pro.
UnlockCommon questions
- Are UUIDs good enough as share tokens?
- Random UUIDs (version 4) are hard to guess. Some UUID versions include time and are more predictable, so prefer a dedicated random token.