Validating

I was just wondering how one could validate the actual user is making a request.

Scenario:

I have a DB with a table like so:

forumID, attribute1, attribute2, attribute3.

Now lets say I write a servlet that does an update on this table, and that each specific "forumID" only belongs to a certain user and should only be updated by a certain user. How can I make sure that the proper user is making the request. Since anyone can just make a request with URL like http://somesite/context/updateForum?forumID=5,attri...., there is really nothing to validate the user.

One obvious method that comes to mind is just store the userID in a session variable (after login lets say) and also store that value with each entry in the table. and then compare entries. However these seems redundant to me and was wondering if there is a better way to do this?

Thanks,

Rob

[905 byte] By [robcioa] at [2007-11-27 3:45:38]