Or,in an alternative approach to authentication and data integrity, we forgo traditional token-based verification in favor of a system where each user action and its associated data payload are authenticated through digital signatures. In this model, users sign every request with their private key. The server then verifies the legitimacy and integrity of these requests by validating the signature against the user's public key. This method ensures two critical security assurances:

Authenticity - By verifying the digital signature with the public key, the server confirms that the request was indeed initiated by the legitimate user, effectively replacing the need for token-based authentication. This process guarantees that the requestor possesses the corresponding private key without revealing it, thereby affirming their identity.

Integrity - Digital signatures not only authenticate the sender but also ensure that the request data has not been altered in transit. Any modification to the original data would invalidate the signature, alerting the server to potential tampering. This ensures that the server processes the user's true intentions as expressed in the request.

This approach simplifies the authentication process by directly leveraging cryptographic principles, offering a clear and robust method for securing user interactions. It enhances security by ensuring both the identity of the requester and the integrity of the request data, providing a streamlined alternative to conventional token-based systems.

I recommend using this approach.

If implementing the second approach is challenging due to significant changes required in the front-end code, making it difficult to achieve in the short term, I suggest that, at the very least, the first approach mentioned above should be adopted.