When sending a request (POST, PUT, etc). I have a security requirement to ensure that the data in the payload has not been tampered with.
In other words I need to know with certainty that the data entered was entered by the user and has not been intercepted in flight with additional or altered data.
What are strategies and tactics to accomplish this?
I thought of using a key from a previous GET request followed by hashing the whole payload along with a timestamp. However I don’t see this as a solution since if there were a reverse proxy or key logger listening to an end-user's requests, then that keylogger and reverse proxy would just as soon know what the key used to hash was and could just overwrite the payload with the key and hash anyway - using the servers expected key and looking like a legitimate hash of the payload. Any ideas?