I noticed that the UID of users is exposed in the HTML code of a page on my site that authenticated users can access.

Is it a problem if authenticated users with "view user profiles" permission are able to find the UID of any non-disabled user account?

  • 3
    Only if there's an unrelated vulnerability somewhere in your site that would let an attacker make use of that ID in a nefarious fashion. Things have identifiers, there's no getting away from that; it's not something you should spend much time fighting or even worrying about. Security through obscurity is a fun related read :) – Clive Nov 21 '18 at 20:33
  • Totally agree with Clive, "Security through obscurity" has nothing to do with security at all. The security from the lock on your door comes from the secret key, not from obfuscating the door handle. – Hudri Nov 22 '18 at 13:06
  • Third vote to agree with the above two. No risk in and of itself. – Jaypan Jan 13 '19 at 23:33

According to this post by the Drupal Security Team, it is not considered a vulnerability:

Disclosure of usernames and user ids is not considered a weakness

Drupal's philosophy

Usernames are an important part of online identity. Having a public username helps other users of a site to know the identity of the person they are interacting with in a forum or a blog. Drupal is primarily intended to be used for sites where identity and interaction are key elements so it is reasonable for that information to be public.

Of course, it will vary by site, depending on what that information allows other users to see.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.