title: Does knowing the Identity ID compromise security?
body: <p>I am looking at a Unit Test project, which contains the following code:</p>
  
  <pre><code>public const string IDENTITY_ID = "9e326389-1ae6-4672-9dc4-7868ab7b7a09";
  
          private readonly RequestDelegate _next;
  
          public AutoAuthorizeMiddleware(RequestDelegate rd)
          {
              _next = rd;
          }
  
          public async Task Invoke(HttpContext httpContext)
          {
              var identity = new ClaimsIdentity("cookies");
  
              identity.AddClaim(new Claim("sub", IDENTITY_ID));
              identity.AddClaim(new Claim("unique_name", IDENTITY_ID));
  
              httpContext.User.AddIdentity(identity);
  
              await _next.Invoke(httpContext);
          }
  </code></pre>
  
  <p>Please note that I have generated a random <code>Guid</code> for the question.</p>
  
  <p>It appears that theunit test invokes the web api (inside the Invoke method) and is able to access a method, which has an Authorise attribute.</p>
  
  <p>Does forumating an identity like this mean the user is authorised?</p>
  
  <p>I am trying to learn more about how Identity Server works and hence the reason for the question.</p>