Skip to main content
Information Security

Return to Answer

added 1 character in body
Source Link
mentallurg
mentallurg
  • 12.6k
  • 5
  • 38
  • 51

It depends on what you mean by sending user ID "with user token".

If you mean "as a part of the token", then it is fine. On server you verify tokens and you will detect if token was modified, for instance if user has modified user ID (to access account of someone else).

If you mean "additionally to the token", then it is a bad idea. Because user can replace user ID with an ID of some other user and you will nonot be able to detect it. It means, every authenticated user will be able to work in the name of any other user: Access data he is not allowed to access, trigger some functions in the application that he is not allow to use.

It depends on what you mean by sending user ID "with user token".

If you mean "as a part of the token", then it is fine. On server you verify tokens and you will detect if token was modified, for instance if user has modified user ID (to access account of someone else).

If you mean "additionally to the token", then it is a bad idea. Because user can replace user ID with an ID of some other user and you will no be able to detect it. It means, every authenticated user will be able to work in the name of any other user: Access data he is not allowed to access, trigger some functions in the application that he is not allow to use.

It depends on what you mean by sending user ID "with user token".

If you mean "as a part of the token", then it is fine. On server you verify tokens and you will detect if token was modified, for instance if user has modified user ID (to access account of someone else).

If you mean "additionally to the token", then it is a bad idea. Because user can replace user ID with an ID of some other user and you will not be able to detect it. It means, every authenticated user will be able to work in the name of any other user: Access data he is not allowed to access, trigger some functions in the application that he is not allow to use.

Source Link
mentallurg
mentallurg
  • 12.6k
  • 5
  • 38
  • 51

It depends on what you mean by sending user ID "with user token".

If you mean "as a part of the token", then it is fine. On server you verify tokens and you will detect if token was modified, for instance if user has modified user ID (to access account of someone else).

If you mean "additionally to the token", then it is a bad idea. Because user can replace user ID with an ID of some other user and you will no be able to detect it. It means, every authenticated user will be able to work in the name of any other user: Access data he is not allowed to access, trigger some functions in the application that he is not allow to use.