If I was storing current_user in the assigns how hard would it be for a hacker to fake that assigns?
Should I do more to assure the assigns is valid?

For example I was reading this auth library example for phoenix

One thing that I don’t like about this pattern is that it expects that you pass the user’s id as a request param and then it compares it to the current_user in the assigns as an extra layer of authorization.

I don’t want to expose the user’s id if I can avoid it so I wonder if this is even necessary
if I can trust my assigns in my plug then I can just lock that user to only even being able to load the user from the assigns alone.

Thus not needing to expose their ID via the params which I feel is a greater risk because of the higher likelihood a hacker would try to use it via a sql injection but, that assumes I can trust my assigns. If I can’t then this makes more sense and in that case I may be better off migrating my ids to UUID for users if only to obscure that vector attempt

Thoughts?