Constituent ID - RE security

Kevin Hardy
Kevin Hardy
Ninth Anniversary Kudos 2 Name Dropper Facilitator 1
in SKY Developer General Discussions

Are there any risks to using the Constituent ID in a public profile URL? (outside of Raiser's Edge, but loosely integrated on the back end, hence the usage of the constituent id)

For example, given this RENXT URL:

host.nxt.blackbaud.com/constituent/records/5587458

Is it ill-advised to use 5587458 in a public facing app?

Ex:

myprofiles.com/5587458/default_profile (this could be a link in an email)

I'm trying to figure out what risks there might be, if any, for someone seeing this unique constituent id. Or if a different key field should be used. Or if we should come up with an alternative hash.

Thanks for any advice!

Comments

  • Neil Curtis
    Neil Curtis
    Fourth Anniversary Facilitator 1

    I can't see that it would be harmful using the system id of the constituent as anyone who has it would need access to your environment to see the details of the constituent.

Categories