Each user has multiple sites they can access reporting data for in an application I am working on. To prevent having to go to the database on every single request, I validate that they have access to the site only when they change sites and I then store the the current site id in the session.
I am trying to eliminate session state so that my async ajax requests are not synchronized and also so that the user can have a different site open on each browser tab. I also don't want to go back to calling the database on every request to validate that the user has access to the given site making a request. I've seen implementations where people will encrypt the id on the client, but it's not sure what would prevent a third party from looking over someone's shoulder (seeing the id on the query string perhaps) then using that same id with their own login to make a request.
I have two ideas:
1) Encrypt the id with the persons authenticated user name as the seed... Then encrypt it again with some private key. When the request comes in I would decrypt with the private key then try to decrypt with the current user name and get the id back. Or perhaps I would combine the user name with the id like firstname.lastname@example.org_[SITEID] then encrypt that with the private key and split them to see if the current username matches the first part. The problem with this though is that it never expires really, so they could in the future make a request even if they have lost access as long as they have the id around.
2) Similar to idea 1, but I would use the session id with encryption as a third key perhaps. The problem here though is if the session expires and they leave a tab open, all the requests would fail from the tab that was left open even though a session is active.
3) Use a cache so that async requests are not affected and just store keys like email@example.com_[VALIDATED_SITE_ID] then see if the key exists when the request comes in and if not, hit the database to establish the validation key.
Has anyone addressed this type of scenario where you need to validate the user can make a specific type of request, yet you doing it without session or hitting the database every time a request is made?