Essentially this is fine, you are only “leaking” someones userID and most users are not really gonna be digging about looking at the packets you are sending to your extension to try and break in so sending a userID doesn’t matter to much since those are public.
It’s not “bad”