Back
How can I prevent a user calling a function on behalf of another user?
TL;DR
The user is asking how they can prevent a user from calling a function on behalf of another user. They have a friends collection where users can add other users as friends. They pass their own user ID and a unique friend code in a JSON payload to the function. The concern is that another user could potentially add friends for someone else if they have stolen their user ID. The function is only executable by logged-in users. The user is asking for a way to verify that the person calling the function is the rightful owner of the provided user ID.
