Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add a recommendation to manually set the DJANGO_SQIDS_ALPHABET setting #5

Open
wants to merge 3 commits into
base: main
Choose a base branch
from

Conversation

apoorvaeternity
Copy link

By customizing the DJANGO_SQIDS_ALPHABET string, we can prevent the issue of generating the same IDs as those generated by other projects using the default alphabet.

Verified

This commit was created on GitHub.com and signed with GitHub’s verified signature.
@julianwachholz
Copy link
Owner

Sorry for not getting back sooner, I've been thinking about this notice a bit.

Personally, I want to avoid any references to potential "security" issues as this is not a security library and must not be used as such. Mentioning that it's recommended to change the alphabet (I don't think it is, I haven't seen this mentioned anywhere around the Sqids project?) might make people think it's for better security or similar.

Because of this I'm closing this for now.

@apoorvaeternity
Copy link
Author

apoorvaeternity commented Sep 23, 2024

@julianwachholz - No worries. I know djando-sqids is purely visual and providing a random string won't change anything in terms of security. It was just to ensure that the outputs were visually unique.
I saw this recommendation in: https://github.com/sqids/sqids-dotnet#customizations and felt it would be a nice addition here.

@julianwachholz
Copy link
Owner

Thanks for the link. This Python package does provide a small shuffle_alphabet utlity to achieve the same effect. Would you like to mention this in the README instead?

@apoorvaeternity
Copy link
Author

@julianwachholz Sure! I saw the shuffle_alphabet utility.
The only caveat with it is that it has to be run manually to get the output, which is a tad cumbersome, so I opted for the online utility.

I guess we can mention both like this:
You may use the shuffle_alphabet function provided with django-sqids or an online tool like [this one](https://codebeautify.org/shuffle-letters) to shuffle the default string.

WDYT?

@julianwachholz
Copy link
Owner

Sorry, I do not wish to link to a third party site for this. I am interested in adding the function as a script to be invoked (manage.py or python -m)

@apoorvaeternity
Copy link
Author

@julianwachholz Okay - let's just keep it as:
You may use the shuffle_alphabet function provided with django-sqids to shuffle the default string.

Verified

This commit was created on GitHub.com and signed with GitHub’s verified signature.
@apoorvaeternity
Copy link
Author

@julianwachholz - Do you have the option to re-open the pull request? If not, I can create another one.

@apoorvaeternity
Copy link
Author

@julianwachholz - I am going to add a script to generate a random string that can be used as DJANGO_SQIDS_ALPHABET. I was thinking of adding it as a management command but then the django_sqids app would have to be added to INSTALLED_APPS, which isn't a requirement at the moment.
Eitehr we can ask users to add django_sqids to INSTALLED_APPS going forwards and create a management command or we can just create a script which would return a randomised string using the default alphabet.

python -m django_sqids.generate_random_alphabet
t8WPbaXQ30R9umoTCAHBIswgUNqhlLpYdxvJGkfzrSeKD1VMcZj7O42Fi5E6yn

It is probably a one time use thing per-project anyway(unless the user is manually providing a different alphabet for each field)

WDYT?

@julianwachholz
Copy link
Owner

Agreed the python -m way is quick and clean. :)

@apoorvaeternity
Copy link
Author

@julianwachholz - have added a small script for random alphabet generation.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants