title: How to Limit REST API to User-Specific Content
body: <p>I have a fairly simple API setup on a MEAN stack using PassportJS. I have no problems setting up my routes with no security (grabbing general data) and with user authentication (secure information). However, I cannot seem to find a best practices for granted user-based access.</p>
  
  <p>For example:
  /api/users/:id is a route that requires authentication. So you can never get user information without an access token.</p>
  
  <p>However, once I have a token, I can simply send that with a request and someone ELSE's id to access their content instead of their own. Albeit, the id's are long messy things, if someone where to get a person's ID from the system, they only need their own password to access that data.</p>
  
  <p>I considered saving the token in a new collection called sessions and doing additional verification to match the token/userId combo.  But I don't know if that's the best practice.</p>
  
  <p>Does Passport handle that auto-magically and I missed that part?</p>
  
  <p>Thanks,
  Wayne</p>