When a user logs in, we authenticate them. It's easy to pass back the primary key of that user record in the DB and on subsequent calls in, pass that PK to identify the user. It's also trivially easy to then impersonate any user.
What's the best way to implement this? The two things I have thought of are:
- Return a guid and require that guid on all subsequent calls.
- Store the PK in the Session data on the server side and use that to identify the user on all subsequent calls.
Both of the above work if an existing session continues to go to the same server (which I believe it does) for each subsequent request.
So, what's the best way to do this? Either of the above two? Or is there another approach that's better?
thanks - dave