I've created a website for a tennis league. The two main pages are standings and schedule. When a user accesses the site, I'd like to have them select the league and season first. For example, the site could host standings/schedules for multiple leagues. So the user could select league ABC and season Fall 2016.
For each Web API request after the user selects league and season, I'd like the Web API to remember this selection for the user. I could store the values when the user first selects them:
HttpContext.Current.Session["League"] = league;
Then, in subsequent calls, the Web API knows the league to use when getting the standings.
This can be bad for two reasons:
The Web API is no longer stateless, and the call from the browser would have to hit that specific Web API server on future calls.
If the Web API server is rebooted, we lose that data and would have to deal with it on the client/web side.
I could forget all that and store the league in session on the browser, then pass that info to the Web API. However, we shouldn't be trusting info from the browser. What's to stop someone from using dev tools in the browser and entering any league they like?
Another option would be to store the league selection in the DB for the user, but then I'm making extra DB calls for each request to retrieve this info.
I know I'm missing something, as this has to be a common issue that's been solved. What's the right way to remember the league for a user after they originally select it? The server side needs the league so it can get the correct standings/schedule for it on subsequent calls.