The alternative isn't storing user ID and sending it around but generating a unique session token that's stored for example in your DB. See how PHP does it (ses

The alternative isn't storing user ID and sending it around but generating a unique session token that's stored for example in your DB. See how PHP does it (session_start etc).