Suppose I have two entities as follows:

```java
@Entity
public class ClassA {
    private Long id;

    public Long getId() {
        return id;
     }

    public void setId(Long id) {
        this.id = id;
    }

    @OneToMany
    private Set<ClassB> classBs = new HashSet<>();
}

```

```java
@Entity
public class ClassB {
    private Long id;
    private String name;

    public Long getId() {
        return id;
    }

    public void setId(Long id) {
        this.id = id;
    }

    public String getName() {
        return name;
    }

    public void setName(String name) {
        this.name = name;
    }
}

```

That is, ClassA contains a Set of ClassB. And a resource like so to update ClassA:

```java
@RequestMapping(method = RequestMethod.PUT)
public ClassA update(@RequestBody ClassA a){
    // Update code here
}

```

and then in a DAO (using hibernate) the following is called to update ClassA in the database:

```java
@Override
public ClassA save(ClassA classA) {
    sessionFactory.getCurrentSession().saveOrUpdate(classA);
    return classA;
}

```

In an **update** scenario if an authenticated user changes the `id` of an instance of `ClassB` to an `id` belonging to another user we find that there are no protections from stopping the user updating objects which do not belong to them. Are there any methods of preventing this? What is best practice to prevent this from happening (i.e. preventing them updating another users `classB` details)?