logoalt Hacker News

knomeyesterday at 5:51 PM1 replyview on HN

creating your uuids client side has a risk of clients toying with the uuids.

creating them server-side risks having a network error cause a client to have requested a resource be created without receiving its id due to a network error before receiving the response, risking double submissions and generally bad recovery options from the UI.

if you need users to provide uuids for consistent network operations, you can have an endpoint responsible for generating signed uuids that expire after a short interval, thereby controlling uuid-time drift (must be used within 1-5 minutes, perhaps), ensuring the client can't forge them to mess with your backend, and still provide a nice and stable client-side-uuid system.

for the uuidv47 thing, you would apply their XOR trick prior to sending the UUID to the user. you presumably just reverse the XOR trick to get the UUIDv7 back from the UUIDv4 you passed them.


Replies

Lvl999Noobtoday at 5:26 AM

Why not have a transient client generated ID for idempotency but a server generated ID for long term reference and storage?