In the system that I am building, users create their own public JSON files on the Internet, available to anyone. My system does not store these JSON files nor have anything except read only access to those files.
When my software grabs one of these JSON files and examines it, I need to know which of my users that file belongs to.
I have a vague idea of a solution but I'd like some feedback:
I will require the user to include a field in the JSON containing some bit of signed information, perhaps their userid. My software provides the user with this string of information to include in their JSON.
In my software, the user must specify the URL that the JSON can be found at. This allows me to ignore any JSON files where the user has not also specified the URL.
Thoughts? Does this make sense? Any issues? thanks!