How to make sure that the chat message was sent from a specific user, and not from someone who pretends to be one?

Question

Information Security

Let's say there is a stateless server (backend) and a web server (website). The website has sessions, but the backend doesn't.
Let's say there is also a chat. For some reason, the chat itself works on the backend, but its web face is on the site.
Question: how to make sure that the message is sent from a specific user, and not from someone who pretends to be one?
PS: I forgot to say that a mob is expected in the future. Appendix.

Answer 1

Session+Cook

Answer 2

https://ru.wikipedia.org/wiki/%D0%9C%D0%B5%D0%B6%D...