I'm building a note-taking app, when a user writes a note an id is generated and I redirect them to a page where they can see its content with a URL like
/note/DXSt832pS5iLuos6uxBn. What are the security risks of not double-checking that the user has access to this page, and simply trusting that if they know the id they're authorized?
The id is an autogenerated id from firestore. I found this answer speaking about how it should be as unique as a guid and crypo quality random.