title: How to validate a user during a web session?
body: <p>Well, I have now implemented session handling but I am not quite sure how to work with that.</p>
  
  <p>My concern is the following:</p>
  
  <p>Let's say a user is logged in and wants to get a list of items from a specific store. So the client will send me an <code>id</code> for a store. That <code>id</code> will be linked to an actual id for a store entity that I use in my MySQL database. An intruder could just exchange that <code>id</code> and therefore receive back the "wrong" data from my server.</p>
  
  <p>Here is my question: Is it enough to send the session ID over HTTPS inside the payload in order to be safe here? Is there anything else I <strong>have to</strong> consider if I don't want hostile users to be able to lure information from the server that they are not supposed to see? I am rather new to web development but I am writing on something that is supposed to become something like a commercial software in .. well someday :D but however, even if it was for the sake of learning something new, how is this done safely?</p>