Is it safe to use Python UUID module generated values in URL's of a webpage?

Question

Is it safe to use Python UUID module generated values in URL's of a webpage? Wnat to use those ID's as part of URL's. Are there any non-safe characters ever generated by Python UUID that shouldn't be in URL's?

Answer 1

They are safe. See here for all possible output formats. All of them are readable strings or ints.

Answer 2

It is good practice to always urlencode data that will be placed into URLs. Then you need not be concerned with the specifics of UUID or if it will change in the future.

Answer 3

I use GUIDs mainly as primary keys and often need to pass them around as URL arguments.

The hexadecimal form, with the dashes and extra characters seem unnecessarily long to me. But I also like that strings representing hexadecimal numbers are very safe in that they do not contain characters that can cause problems with URLs.

Instead of hexadecimal, I use a url-safe base64 string. The following is some Python code that does this. It does not conform to any UUID/GUID spec though (other than having the required amount of randomness).

import base64
import uuid

# get a UUID - URL safe, Base64
def get_a_Uuid():
    r_uuid = base64.urlsafe_b64encode(uuid.uuid4().bytes)
    return r_uuid.replace('=', '')