How to protect the service API from fake requests?

Question

API

So, we have:

• API
  
• Client application (VK Mini App), which is nothing more than a user-friendly interface that implements API functionality
  

We have a user who has user_id.
The API has a method someAction.performthat interacts with the database and changes something there. I need to somehow check that this request was sent by this user, namely through the client application, and not some villain who sends requests with curl and substitutes someone else's user_id. I also want to emphasize that I work through VK, so my users do not have passwords or logins in my service, and that the client application can be easily reverse engineered.

Answer 1

Read the documentation for VK Mini Apps, section Signature launch options . There are also links to examples of the implementation of signature verification.
The user comes with a bunch of parameters , including the user_idrequest signature sign, which you need to check on your server. It is tied to the "secret" of the application.
So you can make sure that the right user came and the parameters were not faked.
Further, the same parameters can be passed with each API request, and checked again in the handler.
Or, a little more difficult, generate a temporary unique key, store it in your database / Redis, and pass it in the headers of all API requests.

Answer 2

not to get up twice

Answer 3

It is necessary to associate the user and the secret key for signing requests using a third-party responder.
Check: is it possible to transfer data around the ring: your service -> application -> vkAPI -> and .. bouncing vk to your service, bypassing the client?
If it's possible, you can sign your requests and check the signature against vk response/responder for a particular user (only you know the secret key, and only VK knows the user).
No other way.