Permanent Tombstones & Reservation Registry
How Shortyy prevents code recycling and hijacking attacks through permanent cryptographic tombstones.
Permanent Tombstones & Reservation Registry
In many legacy URL shorteners, deleting a short link returns the short code (e.g. bit.ly/mycode) back to the public pool. This enables catastrophic link recycling attacks:
▪
Company A deletes a short link used in historical print magazines or SEC filings.
▪
Malicious Actor B registers the exact same short code.
▪
Every historical click now lands on Actor B's phishing site.
Hijacking Prevention
In Shortyy, short codes never return to the available namespace.
When a link is deleted via DELETE /v1/links/:id or automatically culled upon expiration:
▪
The link record is marked
is_deleted = true.▪
The code is inserted into the
reserved_codes registry with a reason of tombstone.▪
Subsequent requests to
POST /v1/links attempting to claim that custom code return HTTP 409 Conflict.▪
Visitors requesting that short URL receive
HTTP 410 Gone rather than being hijacked.