Should primary keys of MySQL tables be exposed?

Question

I have a number of MySQL tables describing models such as \"User\", \"Business\" etc. Should the primary keys of these tables ever be exposed to the client-side? I am asking

Answer 1

In general, it's OK to post whatever data to the browser. But don't forget:

Any data passed to the client and passed back to the server might be compromised in any way. Don't trust data returned by the client!

Unfortunately, if you post keys - somehow - the user changes it and you fail to correctly verify the key, if posted back from client to server, harmful things might happen.

Thus, you should write very defensive code regarding client-to-server-post/get keys. In fact, you shouldn't trust any data posted back from client to server.

My question might be of interest too.

As stated in my question, my latest application never ever posts identifying data to the client. More generally, not even those stuff typically used as parameters in GET/POST parameters ever get written to the client.

All keys or somehow entity related attributes which control the flow of the application are strictly server-side only.

What I proposed as alternative D) in my question provides this:

• Any request received by the server is valid by default, since all valid link gets born at page-rendering time, rather than at request time.
• User can't forward links using email or post them, since they only exists while his or her session is active.
• User can only request those links inside a web-page, since only these links are registered at the server-side.
• All state related data is keep at the server side, and thus unchangable by the client.