Question

I would like to know if is there a secure issue id I set the _id of my user in cookie to identify users or it will be better to set a cookie username and an otherone encode pwd

thanks

Answer 1

Yes, that is absolutely a security risk — it means that, if a user can discover the _id of another user (e.g, if you accidentally display it somewhere), they can log in as that user. Worse yet, the _id cannot be changed after the fact, so there’s no way to force another session to remotely log out, or to recover from a stolen cookie.

Use sessions for login, not user-specific data.