title: sending userId by params vs extracting it from JWT token
body: <p>I want to discuss one thing.</p>
  <p>Suppose, I have a POST API that is JWT authenticated, supposed I want userId in this API. Here I can think of two approaches</p>
  <ol>
  <li>either send userId using the post body</li>
  <li>extract it from the JWT token itself</li>
  </ol>
  <p>Now the second approach makes more sense for some cases like a follower followee API</p>
  <p><strong>but my main questions are:</strong></p>
  <pre><code> 1. is going with the extraction from JWT token approach, a significant step toward increasing security?
   2. Is there any cons to using this approach?
  </code></pre>