I want to implement the "shopping cart" feature on my website. Both anonymous/unauthenticated and authenticated can have it.
While it's clear how to implement it for an authenticated user, it's not completely clear for the anonymous/unauthenticated user case. I believe that I'll have to create a long id, such as GUID or the like, in a database and install a cookie with that long id/GUID, right? Not just integer 32/64 id, because an integer id will be easy to guess or bruteforce, correct?
On the other hand, the threat model of guessing an integer id of a shopping cart isn't high -- it's not a big issue if I guess a shopping card id of some anonymous/unauthenticated user, I think. Right?