nightwielderOriginal post
Rank 2: Process
I have a collection of post, with an attribute called userId, where I keep the poster's ID. And the posts are made by calling
databases.createDocument(db, col, ID.unique(), {...data, userId: currentUser.$id}
This obviously sends a POST request to the Appwrite server but what worries me is, someone can use DevTools to mimic that request and put something else in the userId field, and it would seem as though someone else has posted that.
What to do in this case?
Summary
The user wants to know if they can achieve the same functionality in a custom endpoint on a different server as they can with an Appwrite function endpoint. They provide code examples and explain that they want to prevent someone from spoofing the ID when making a post request to the server. They are concerned that someone may use DevTools to manipulate the `userId` field. The user is looking for guidance on how to handle this situation.
Solution: To prevent someone from spoofing the ID, the user can authenticate the request by validating the user's credentials in the custom endpoint. This can be done by retrieving the headers from the request and getting the