I have easily guessable internal identifiers (auto increasing numbers) and I'd like to give my clients access to resources based on these identifiers.
Of cause I cannot provide them with an URL like:
https://example.com/order/13
because they could easily guess how to access order #14 from this URL.
I therefore thought about providing them with a salted hash of the identifier like:
https://example.com/order/4643ef…
where
4643ef… = sha256(13 + 'supersecretsalt')
Is this a good approach from a security perspective?