Should UUID for unique IDs be mandated?

[inexorabletash]

UUIDs are awesome.

But I notice that http://www.w3.org/TR/FileAPI/ goes out of the way to only make use of UUIDs a SHOULD not a MUST for unique IDs. Do we want to require the use of UUIDs for SW, or use less strict requirements, like File does?

(Also... if this is the first place in the platform that is outright requiring UUIDs, should we be good anti-magicians and add a UUID-minting function somewhere? Not in the SW spec, of course...)

[jungkees]

I don't think we should mandate it. It should just be a unique id but with some constraints I guess.

@annevk pointed out the privacy implication of the id at #643

The app: URI scheme spec also uses UUID and has a similar privacy and security considerations: http://www.w3.org/TR/2013/WD-app-uri-20130516/#privacy

So, I think I have to update the text considering those points. Please let me know if anyone has a more specific suggestion.

[annevk]

I think the File API is wrong in not requiring something specific. Having said that, I'm not really sure we need UUIDs. The identifiers need to be unique per-origin, not globally. Having them globally unique might actually not be good for the user.

As for a primitive, the Web Crypto API defines a randomness primitive.

[jungkees]

An id being unique per origin means the object can be accessed in globally unique manner during its lifetime (i.e. origin + id). So its security implication is not different from using a UUID I think.

[jungkees]

Using and requiring UUIDs should be fine here. We're not adding any new level of privacy concern. Same ids can be in IDB for example. And they don't live longer than the cache clearing lifetime.

Closing.

[jungkees]

Having discussed with @michael-nordman, it seems the implementers want more flexibility in how they use the types for ids as they're minted from inside the platform. I thought requiring a uuid seems better as otherwise devs will see different types of ids from different browsers. What do you think about altering this requirement?

FYI, Chrome's using a string serialized from a 64-bit interger.

/cc @wanderview @slightlyoff @jakearchibald

[jungkees]

F2F:

• Not mandating UUID but use an opaque string?
• Seems we don't need it so move it to milestone 2

[jungkees]

Addressed: 66ff7c7.