I have a multi user site which in which
- a
user
can have manyrestaurants
, - each
restaurant
can have manymenus
and - each
menu
can have manyitems
.
For security purposes, I was going to add a user_id
foreign key making a reference to the user.user_id
column from each of the pertinent tables. That way, when updating the data, I can use the id
of the row they are updating in combination with their user_id
(stored in a session at the application program level) to ensure they don't maliciously update or view another users
content.
Questions
- Is this a common practice?
- Is it still normalized to do this?
Responses to comments
The code is only running on a website I control. But I want to prevent a user
from accessing a row of data that he/she does not own, based on his/her user_id
value. For instance, at the application program level, if they send a GET request to /menus/1
it will retrieve the row from the menu
table with the id
value of 1.