How can storing a userId as client-side-sessions be safe?

Question

The documentation for session handling in ninjaFramework states:

[...] Ninja uses so called client-side sessions. The cookie itself stores the information you want to attach to that session. [...] Ninja sessions are not encrypted by default. Therefore you should not store any critical information. Storing a user id, or username is fine

What makes storing the userId "fine"? The way I understood this client-side-sessions are basicly a cookie with attributes in clean text.

What prevents an attacker from just changing it's usersId in the session and therefore becoming another user (without logging in) to the server?

Answer 1

While unencrypted, Ninja sessions are signed:

A Ninja session is a hash of key/values, signed but not encrypted by default (see next section to enable encryption). That means that as long as your secret is safe, it is not possible for a third-party to forge sessions.

So integrity is ensured for the sessions. The warning you quoted is talking about confidentiality.