46 Replies
I`m trying to create seed owner , but how implement that if im using Asp.Net Identity?
Unknown User•2mo ago
Message Not Public
Sign In & Join Server To View
It's my first project, that's why , i just don't know what's best practice
This
IdentityUserRole<?????>
sb IdentityUserRole<string>
just noticed that in your code.Use valid guids, you can generate them via https://www.guidgenerator.com/
Free Online GUID Generator
Free Online GUID / UUID Generator
Unknown User•2mo ago
Message Not Public
Sign In & Join Server To View
I sensed based on the sample code provided this is using Identity in some way and seems to be bypassing the built-in managers. I agree and disagree with GUID's, there is controversy when to use and not use over PK <int>'s most of what I understood it revolves around large datasets and the indexing of GUID's is not ideal.
SQL Server by all means can auto-populated a GUID PK with the
NEWID()
as well you can have EF use it with the HasDefaultValueSql(NEWID())
conventions.
I see many of the Online streaming services using GUID's for ID's, maybe that's why their so damn slow.... 🤦♂️Unknown User•2mo ago
Message Not Public
Sign In & Join Server To View
---
using
int
for id is great and all, but make sure you don't expose the id to the frontend
you don't want someone iterating over your database by just trying out all the possible IDs (1, 2, 3, 4, 5, until they hit a 404 Not Found
)Unknown User•2mo ago
Message Not Public
Sign In & Join Server To View
I am not talking about accessing restricted data
ofc in that case the issue is different
setup:
you are google maps, each business has a numeric, incremental, id
would you like for a random script kiddie to iterate over all the businesses in your database?
it is public data, sure, but making a dump of an entire table is not what a "normal user" would do
only someone that wants to build a database based on your database would do that
so preventing that is important
TeBeCo
i agree that in some rare case it matter
Quoted by
<@689473681302224947> from #Ef core seed (data) (click here)
React with ❌ to remove this embed.
Unknown User•2mo ago
Message Not Public
Sign In & Join Server To View
it's not a "rare case"
if my user id is 1000, I instantly know that there are 999 other users, do you want me to know?
Unknown User•2mo ago
Message Not Public
Sign In & Join Server To View
ig I am too ready to "fight" 😔 , it's ok
Unknown User•2mo ago
Message Not Public
Sign In & Join Server To View
scraping proxies are a thing, would you ask why the dev doesn't use cloudflare and has the "I am under attack mode" next?
Unknown User•2mo ago
Message Not Public
Sign In & Join Server To View
rate limiting doesn't prevent a billion different IPs from making one request each
Unknown User•2mo ago
Message Not Public
Sign In & Join Server To View
true
very true
Unknown User•2mo ago
Message Not Public
Sign In & Join Server To View
I know that some people do have that money, but it's for DDoSing and not scraping 😔
Unknown User•2mo ago
Message Not Public
Sign In & Join Server To View
some random uhh company is sending spam DNS requests to all possible IPv4 addresses
and I had to tune my company's firewall rules, but it's a different IP every time
Unknown User•2mo ago
Message Not Public
Sign In & Join Server To View
nah that's different altogether
Unknown User•2mo ago
Message Not Public
Sign In & Join Server To View
out of context for here
Unknown User•2mo ago
Message Not Public
Sign In & Join Server To View
I change subjects quite fast
the DDoS isn't connected to that
Unknown User•2mo ago
Message Not Public
Sign In & Join Server To View
it's called being talkative and being bad at convos
Unknown User•2mo ago
Message Not Public
Sign In & Join Server To View
the DDoS part was related to the money, not an argument to the id
out of context
Unknown User•2mo ago
Message Not Public
Sign In & Join Server To View
yes they don't
I agreed with you on the money part
Unknown User•2mo ago
Message Not Public
Sign In & Join Server To View
I was going to suggest mapping it, but I am not aware of a good way, maybe doing random hex bytes using the id as the seed, but that may have collisions
but then how would you recover the id from the random hex bytes?
needs some good thought
Unknown User•2mo ago
Message Not Public
Sign In & Join Server To View
in most cases, in internal tools you don't even care about the ID being incremental ig
Unknown User•2mo ago
Message Not Public
Sign In & Join Server To View
and then you have McDonalds india to mess up authentication and you can access the orders of others 🤣
Unknown User•2mo ago
Message Not Public
Sign In & Join Server To View
yeah, it (the id) really doesn't matter in a well designed backend