Hello All,

I recently noticed that when I am logged into a DNN site, and when I click on my profile, I see the following URL

http://www.dotnetnuke.com/UserProfile...

I have replaced my userid with 999999 as you can see.  However, if I change the values to real world values, I can see the username (only) of all the users on the site., ie 999998, 999997, 999996, 999995, 999994.  You do see an error if the selected value does not exist of course.

With 5 - 10 mins scripting, anyone can harvest all the sites usernames and corresponding UserIds.

I presume there is an argument that knowing the username only does not compromise ones security, but surely it does give away something that would be better kept secret?

I am also presuming that encrypting the userid in that URL would break some other dependencies, but shouldn't this publicly visible userid / username combo be something to eliminate.

Sorry if this has been discussed many times before - I am just curious to hear your views on this

thanks 

Mark

---

Mark Breen Ireland 1987 BMW R80 g/s

Hello Cathal,

Thanks for your detailed reply.  You are right of course, we are only displaying Display Names, sorry for worrying you about Usernames.  

I agree that what the user can catch from the Display Name is limited.

In any code that I build, where I am forced to pass a value in the URL, I encrypt it, and while I am still not 100% happy about passing that value, at least it is encrypted.

IMHO, another benefit of the encryption is that it cannot be simply enumerated, whereas with a numeric value, we can start at 1 and work up.

May I ask two further questions (Not Urgent BTW):

1) Would it be worthwhile encrypting the UserId in the URL - or would that bring too many complications to justify it?
2) Why do we need to include the UserId in the URL at all?

Thanks again for your response, and sorry for the false alarm re usernames.

See you in Hamburg

Mark

---

Mark Breen Ireland 1987 BMW R80 g/s