X-User-Id can easily be forged

[vseae]

What is the type of issue?

No response

What is the issue?

https://mpp.dev/guides/subscription-payments
According to the documentation, in subscription mode, the client actively passes the X-User-Id header, which the server then parses to associate the user's subscription information. However, this X-User-Id can easily be forged.
What is your recommended implementation standard for a production environment?

Where did you find it?

https://mpp.dev/guides/subscription-payments

[brendanjryan]

Hi!

In a production environment we recommend using a flow like ref in order to provide a strong ownership guarantee.

We made this a little simpler to implement in #578