Question

I’m writing an application that has JS on the client and php on the server, openned session at the server and their “in the php script” I identify each user by a unique ID retrieved from DB and stored in $_SESSION["uID"] at first I thought that this is enough while sending user data from javascript to php, as the session would handle the identification issue and each user request will be recieved by its own session, and hence no user session would conflict with another..am I right? or I have to use another technique?
Do I have to send the user id from js to php? or it is enough to be declared in php?
Do I have to use session Id or something?

Answer 1

Sending User Id by js would make your applicator insecure. Anyone could become anyone.
If session is set by cookies, it’s enough to use that session in php end. You don’t have to sent session Id by js as it get automatically sent by your browser by cookies.