验证POST请求

Question

I'm creating a tampermonkey userscript that sends a POST request from a website containing the user's high score. Something like this for example:

$.post('https://example.com/scores', {
    id: 123, high_score: 999,
});

However, the issue is it's very easy for users to forge a fake score and send their own POST request with a fake high_score . Would there be a way to somehow authenticate these requests so I could differentiate between real requests from my userscript and forged fake ones from users? Perhaps some encryption/decryption?

Answer 1

you can add a hidden input into your page with a nonce (number only used once it can be generated based on the platform you are using (unique identifier)) value in it, when you send the post read the value and add it to you post body, on the server side you check if this nonce exists in the database then this post is authentic otherwise it is not. On your back end you could save this nonce with the session if you have sessions, this is an example

<input type="hidden" value="your-nonce" id="your-id">

<script>
let nonce = $("#your-id").val();
$.post('https://example.com/scores', {
    id: 123, high_score: 999,nonce
});
</script>