title: Security concerns with GAE user_id as a datastore key
body: <p>It is well known that the only reliable way to enforce a unique property in a Google Cloud Datastore kind is through a key property. So let's say we were building a Google AppEngine (GAE) application using the Google Users API to authenticate users, and we wanted to create a kind called Profile. There can only be one profile per user. It would make sense to store the User object id as the key property in order to enforce this uniqueness, right? In fact, the <a href="https://cloud.google.com/appengine/docs/standard/python/users/userobjects" rel="nofollow noreferrer">Google App Engine User API documentation</a> even says this:</p>
  <blockquote>
  <p>Using User Values With the Datastore</p>
  <p>The user ID is stable; you can use it in a key name or as a string property. Therefore, when using user values, you want to store the user ID</p>
  </blockquote>
  <p>But suppose our app needs to show, in the browser, hyperlinks to these user profiles. Is it appropriate to form the url with the <code>user.user_id()</code> string? Shouldn't the user id be treated as sensitive information? A person's Google account user_id is the same across all Google applications. Leaking to a browser doesn't seem right, but I can't find any prohibitions in the GAE docs (unless I am missing something).</p>
  <p>Now <em>if</em> the user id should not be leaked to the client, is it supposed to be hashed? Or is there some other way to design a kind in which the Google user id should be unique?</p>
  <p>Note: I'm fine using the user id as a key and comparing it to the <em>current user</em> in authenticated endpoints, for example. The question has to do with whether it can be exposed to a browser (doesn't feel right) and if not, how one in general handles cases where the owner (application user) of a resource (such as a blog post) needs to be visible within the application.</p>