For example, one remote method will accept a "userID" string passed through the remote method. Once the remote method is called, it takes that ID that is passed and performs work on it.
Our security team brought up an issue where someone can use an external tool (like Fiddler) to record the remote calls and then re-submit them. In doing so, security can pass whichever user ID they would like and our Apex remote method will take that User ID without issue (since there is no security being enforced). Normally we control which users a user can perform work on through our UI logic - but by using a tool to record and re-submit, they can bypass the UI entirely.
This means that one external user who is not in any way, shape, or form related to another can take that other's user ID and perform work on it.
Does anyone know of anything we can do to tighten these remote calls?