# Quick Json Security question

**URL:** <https://meta.discourse.org/t/quick-json-security-question/150061>\
**Category:** Support\
**Created:** [May 1, 2020, 12:56pm UTC](https://meta.discourse.org/t/quick-json-security-question/150061 "2020-05-01T12:56:04Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jim.Morrison](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/jim.morrison/32/162161_2.png) [@Jim.Morrison](https://meta.discourse.org/u/Jim.Morrison)\
**Post date:** [May 1, 2020, 12:56pm UTC](https://meta.discourse.org/t/quick-json-security-question/150061/1 "2020-05-01T12:56:04Z")

</div>

Happy May everyone 👋

Talking with our Security team they were curious why the userid is in the json for the categories and exactly are these json are there for?

Their primary concern about is for example, if we decide to delist a topic due to security reasons (which we have done before), could this metadata somehow leak them?

I appreciate the feedback, thank you!

---

<div class="post-metadata">

**Author:** ![david](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/david/32/157490_2.png) [@david](https://meta.discourse.org/u/david)\
**Post date:** [May 1, 2020, 1:00pm UTC](https://meta.discourse.org/t/quick-json-security-question/150061/2 "2020-05-01T13:00:59Z")

</div>

Hey Jim 👋

> [@Jim.Morrison](#):
>
> why the userid is in the json for the categories and exactly are these json are there for

I’m not sure I understand the question exactly, can you elaborate a little more?

We use JSON to send all information between the server and the client in Discourse. User IDs are included regularly, and are not considered secret.

> [@Jim.Morrison](#):
>
> if we decide to delist a topic due to security reasons (which we have done before), could this metadata somehow leak them?

Unlisting a topic will remove it from any topic lists. This is done server-side, so yes they will disappear from the JSON payload for unprivileged accounts.

Of course, if someone already has the link for the topic, then they could still view the unlisted topic. If you need to completely secure a topic, then it’s best to convert it to a PM.

---

<div class="post-metadata">

**Author:** ![Jim.Morrison](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/jim.morrison/32/162161_2.png) [@Jim.Morrison](https://meta.discourse.org/u/Jim.Morrison)\
**Post date:** [May 1, 2020, 3:45pm UTC](https://meta.discourse.org/t/quick-json-security-question/150061/3 "2020-05-01T15:45:47Z")

</div>

This helped put their minds at ease. Thanks!

---

<div class="post-metadata">

**Author:** ![system](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/system/32/443519_2.png) [@system](https://meta.discourse.org/u/system)\
**Post date:** [May 31, 2020, 3:45pm UTC](https://meta.discourse.org/t/quick-json-security-question/150061/4 "2020-05-31T15:45:53Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.