in my api whenever I get a request I check out the req.user._id which is added to any request when you have nodejs using the passportJS authentication middleware.
My question is this: can a hacker send a post request and fill the parameter of req.user._id with an id that doesn't belong to them?
If not, can you please explain why?