# Use more secure record IDs in URL Parameters for Linked Record Fields

**URL:** <https://community.noloco.io/t/use-more-secure-record-ids-in-url-parameters-for-linked-record-fields/376>\
**Category:** Feature Requests\
**Created:** [March 11, 2024, 1:08pm UTC](https://community.noloco.io/t/use-more-secure-record-ids-in-url-parameters-for-linked-record-fields/376 "2024-03-11T13:08:52Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![nathan](https://dub1.discourse-cdn.com/flex005/user_avatar/community.noloco.io/nathan/32/46_2.png) [@nathan](https://community.noloco.io/u/nathan)\
**Post date:** [March 11, 2024, 1:08pm UTC](https://community.noloco.io/t/use-more-secure-record-ids-in-url-parameters-for-linked-record-fields/376/1 "2024-03-11T13:08:52Z")

</div>

I would like to see any sort of URL parameter for Linked Record fields to use a longer, more secure value that could not easily be guessed.

Since Noloco uses ordinal values, when using its public forms feature, it is easy for users to guess at alternative IDs for URL Paramters passing a linked record field value.

Users could easily add or subtract 1 from a URL parameter and potentially see exposed data from another user.

This vulnerability isn’t an issue with internal tools, but any external form becomes a problem.

---

<div class="post-metadata">

**Author:** ![buildwithjoel](https://dub1.discourse-cdn.com/flex005/user_avatar/community.noloco.io/buildwithjoel/32/1537_2.png) [@buildwithjoel](https://community.noloco.io/u/buildwithjoel)\
**Post date:** [March 22, 2024, 8:40pm UTC](https://community.noloco.io/t/use-more-secure-record-ids-in-url-parameters-for-linked-record-fields/376/2 "2024-03-22T20:40:33Z")

</div>

This is just in reference to Noloco’s IDs right? Guessing so since you said “subtract or add 1”.

Cause with Airtable, though they’re in recXYZ format, it’s pretty needed in the event that you’re trying to, for example, automate sending an email with a link to a particular page and record.

Just making sure I understand, but if we’re on the same page I totally agree! This would be a solid change.

---

<div class="post-metadata">

**Author:** ![nathan](https://dub1.discourse-cdn.com/flex005/user_avatar/community.noloco.io/nathan/32/46_2.png) [@nathan](https://community.noloco.io/u/nathan)\
**Post date:** [March 25, 2024, 1:44pm UTC](https://community.noloco.io/t/use-more-secure-record-ids-in-url-parameters-for-linked-record-fields/376/3 "2024-03-25T13:44:40Z")

</div>

Correct. This is in reference to the Noloco IDs. These are the IDs referenced in URL parameters if wanting to prefill a form.

---

<div class="post-metadata">

**Author:** ![buildwithjoel](https://dub1.discourse-cdn.com/flex005/user_avatar/community.noloco.io/buildwithjoel/32/1537_2.png) [@buildwithjoel](https://community.noloco.io/u/buildwithjoel)\
**Post date:** [March 25, 2024, 1:54pm UTC](https://community.noloco.io/t/use-more-secure-record-ids-in-url-parameters-for-linked-record-fields/376/4 "2024-03-25T13:54:02Z")

</div>

Love it - 100% agree here!  
I guess one possible solution is to allow for UUIDs in prefilling, rather than IDs. That way Noloco doesn’t have to change their underlying architecture:

> [@Prefill a form with a record's UUID](https://community.noloco.io/t/prefill-a-form-with-a-records-uuid/444):
>
> Feature Request: prefill a form with a record’s UUID Context Right now, to prefill a Noloco form via URL parameters, you must include the desired record’s ID (Noloco, i.e. 1, 2, 3, etc). It would be really helpful if we could prefill records by the desired record’s UUID (in the case of Airtable, recxyz). Scenario / Example This would be really helpful for scenarios like the following: You are sending a survey to team members. The survey is a Noloco form, and you want to prefill the “Team Me…

Though of course, both feature requests would be ideal 😅