Exposing database IDs - security risk? -

i've heard exposing database ids (in urls, example) security risk, i'm having trouble understanding why.

any opinions or links on why it's risk, or why isn't?

edit: of course access scoped, e.g. if can't see resource foo?id=123 you'll error page. otherwise url should secret.

edit: if url secret, contain generated token has limited lifetime, e.g. valid 1 hour , can used once.

edit (months later): current preferred practice use uuids ids , expose them. if i'm using sequential numbers (usually performance on dbs) ids generating uuid token each entry alternate key, , expose that.

given proper conditions, exposing identifiers not security risk. and, in practice, extremely burdensome design web application without exposing identifiers.

here rules follow:

1. use role-based security control access operation. how done depends on platform , framework you've chosen, many support declarative security model automatically redirect browsers authentication step when action requires authority.
2. use programmatic security control access object. harder @ framework level. more often, have write code , therefore more error prone. check goes beyond role-based checking ensuring not user has authority operation, has necessary rights on specific object being modified. in role-based system, it's easy check managers can give raises, beyond that, need make sure employee belongs particular manager's department.
3. for database records, conditions 1 , 2 sufficient. adding unpredictable ids can thought of little insurance, or "security in depth," if buy notion. 1 place unpredictable identifiers necessity, however, in session ids or other authentication tokens, id authenticates request. these should generated cryptographic rng.