Name validation in web application?

Question

JavaScript

There is a small web application, a game written in javascript (client side) and node js && socket.io (server side). At the moment, the username is obtained on the client side via XMLHttpRequest from the database ($_session [user_id ] looks and username is found), but the problem is that this name can be faked without any problems and, in fact, absolutely any value can be sent to the server. Any suggestions on how to get the name from the database on the server side? and you won't be able to find the string by "where user_id=?".

Answer 1

Use JWT .
In your case:
1. On the server, we generate a JWT token: payload { "username": ... }
2. Instead of username, we pass the token
3. On the server, we check and get username from the token.