User ID security fixed

Author: gabriel-hahn

api/src/app/routes/middleware/auth.js

@@ -12,6 +12,11 @@ module.exports = async (req, res, next) => {
 
   try {
     const decoded = await promisify(jwt.verify)(token, process.env.APP_SECRET);
+
+    if (req.headers.userId && req.headers.userId !== decoded.id) {
+      return res.status(401).json({ message: 'Request not allowed' });
+    }
+
     req.userId = decoded.id;
   } catch (err) {
     return res.status(401).json({ message: 'Token invalid' });