How to handle this situation

I have a collection of post, with an attribute called userId, where I keep the poster's ID. And the posts are made by calling

databases.createDocument(db, col, ID.unique(), {...data, userId: currentUser.$id}

This obviously sends a POST request to the Appwrite server but what worries me is, someone can use DevTools to mimic that request and put something else in the userId field, and it would seem as though someone else has posted that. What to do in this case?

With a function you can get the user that is triggering it so you prevent someone from spoofing the ID

Thanks! With an Appwrite function endpoint, I can do that.

But can I also do the same in a custom endpoint in a different server? Here's what I want to do, in my web app:

// User is logged in
fetch("https://mycustomserver.com/", {method: 'POST', headers: 'SOME MAGIC'});

And in my server:

headers = request.get_headers()
user = users.get_from_cookies(headers['cookies'])

Something like this. I hope I'm clear.

No idea. I think best way is going with functions and their SDK