title: How to prevent user to access other users' data?
body: <p><strong>PROBLEM</strong></p>
  
  <ul>
  <li>User authenticated into the application</li>
  <li>Simple database schema: User ---> Document ---> Item</li>
  <li>API to access to Document Items</li>
  </ul>
  
  <p>If the logged user knows the id of items that belong to some other user, he can access to it.
  I would like to prevent this behavior.</p>
  
  <p><strong>SOLUTION</strong></p>
  
  <p>The first solution I found is to add a userid field to every records in every table to check at every query if the record belong to the logged user.</p>
  
  <p>This is a good solution? Do you know some better design pattern to prevent the user to access other users' data?</p>
  
  <p>Thanks</p>