I am writing a webservice for research and learning purposes and try to find an approach to seperate user data from other users to ensure a request can never deliver or reveal data from another user.
I give you an example in a slightly different field. Imagine a HTML form whose inputs will be written into a database. There is the browser logic which can ensure the data is valid. Then the script accepting the connection can revalidate the data as well, and often databases have their own constraints. So there are 3 level to ensure no spoiled or incorrect data makes it into the database.
Back to my initial problem. Imagine a database with user text messages. In a naive/plain database model, there would be a
messages table where each message has a
user_id. A SQL JOIN would be the naive solution, but that is way to error prone in my opinion.
Would it be ok to create an entire database for each user to seperate the data even more? Would that be enough? How do modern webservices seperate data?
FYI: The text message example is just an example. Of course I know about end-to-end encryption. But for my webservice this is not necessary to go that far.