title: Avoid exposing primary keys in the source of a web app?
body: <p>I often come across web applications that expose internal database primary keys through forms like select boxes.  And occasionally I see javascript matching against an int or guid magic value that switches the logic.</p>
  
  <p>Is is a best practice to avoid leaking all internal identifiers of rows in your web application to prevent outsiders from understanding too much of your system and possibly using it to exploit your system.  If so what is the best way to solve this problem?</p>
  
  <p>Should you expose some other value to the web app that can be translated back to the primary key?</p>
  
  <p>Thanks</p>
  
  <p><strong>Edit</strong></p>
  
  <p>In a perfect world your application would be 100% secure so it wouldn't matter if you obscured things.  Obviously that's not the case so should we error on the side of caution and not expose this information?</p>
  
  <p>Some have pointed out that Stackoverflow is probably exposing a key in the Url which is probably fine.  However are considerations different for Enterprise Applications?</p>