User authentication using Passport I'm currently building a Node/Express app using Passport for user authentication and Sequelize for database queries. It's a 'To-do list' app which currently has 3 models: User, List and Task. My back-end database calls are done using an API. My front-end uses AJAX to retrieve the data.

This is my first time using Passport for authentication, so I was wondering if there are any security problems in my current code. I am specifically concerned about Users being able to retrieve info about other Users by modifying the requests to my API.

Here is an example of an API call to create a List:

// Create list
router.post('/lists', isLoggedIn, (req, res) =&gt; {
    models.List.build( { name: req.body.name, userId: req.user.id } ).save()
    .then(list =&gt; {
        res.send(list);
    })
    .catch(err =&gt; {
        res.send(err);
    });
});

// ... other API calls

function isLoggedIn(req, res, next) {    
    if (req.isAuthenticated())
        return next();
    res.redirect('/');
}


And the front-end function that calls it:

// Create list and open it
function addList(name) {
    if (!name.length) return;
    $.ajax({
           type: "POST",
           url: '/api/lists',
           data: { name: name },
           success: function(data)
           {
               window.location = "/lists/"+data.id;
           }
         });
}


I am 99% sure that this is a secure implementation, since it seems like any data sent in the POST request is contained within req.body, whereas req.user is generated by Express/Passport on the server side. However there is still the 1% of me that thinks it might be possible to modify req.user in the POST request and be able to get information about other Users.

Are my worries for nothing, or is there a better way to implement this?
Given req.user is set at the server then, unless your server is compromised, you can ignore the 1%. 

Relying on server-side user data is the correct approach - never trust the client.