Also, querying the db is fine. What I meant is that sending the user ID to the backend to identify the user is not fine.