# How to prevent users from using the interface badly?

**URL:** <https://forum.dfinity.org/t/how-to-prevent-users-from-using-the-interface-badly/24608>\
**Category:** Rust\
**Created:** [November 12, 2023, 4:10am UTC](https://forum.dfinity.org/t/how-to-prevent-users-from-using-the-interface-badly/24608 "2023-11-12T04:10:58Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![ltp456](https://sea1.discourse-cdn.com/flex023/user_avatar/forum.dfinity.org/ltp456/32/13636_2.png) [@ltp456](https://forum.dfinity.org/u/ltp456)\
**Post date:** [November 12, 2023, 4:10am UTC](https://forum.dfinity.org/t/how-to-prevent-users-from-using-the-interface-badly/24608/1 "2023-11-12T04:10:58Z")

</div>

I am using ecdsa API to develop a dapp, as the update call will spend cycles, so any method to protect the call? and how to confirm my ECDSA private key is controlled by a canister

```auto
#[update]
async fn sign(message: String) -> Result<SignatureReply, String> {
    // todo check proof

    let request = SignWithECDSA {
        message_hash: sha256(&message).to_vec(),
        derivation_path: vec![],
        key_id: EcdsaKeyIds::ProductionKey1.to_key_id(),
    };

    let (response,): (SignWithECDSAReply,) = ic_cdk::api::call::call_with_payment(
        mgmt_canister_id(),
        "sign_with_ecdsa",
        (request,),
        25_000_000_000,
    )
    .await
    .map_err(|e| format!("sign_with_ecdsa failed {}", e.1))?;

    Ok(SignatureReply {
        signature_hex: hex::encode(&response.signature),
    })
}

```

---

<div class="post-metadata">

**Author:** ![sardariuss](https://sea1.discourse-cdn.com/flex023/user_avatar/forum.dfinity.org/sardariuss/32/39258_2.png) [@sardariuss](https://forum.dfinity.org/u/sardariuss)\
**Post date:** [November 12, 2023, 5:32pm UTC](https://forum.dfinity.org/t/how-to-prevent-users-from-using-the-interface-badly/24608/2 "2023-11-12T17:32:23Z")

</div>

> so any method to protect the call?

You could filter the call based on the caller’s principal, or also require the caller to send you cycles (in motoko with [ExperimentalCycles | Internet Computer](https://internetcomputer.org/docs/current/motoko/main/base/ExperimentalCycles), you should have an equivalent in rust)

> and how to confirm my ECDSA private key is controlled by a canister

Not sure what you mean by that. By design the signature is based on your canister id, so only that canister can sign it this way. At least that’s my understanding.

---

<div class="post-metadata">

**Author:** ![Sormarler](https://avatars.discourse-cdn.com/v4/letter/s/c57346/32.png) [@Sormarler](https://forum.dfinity.org/u/Sormarler)\
**Post date:** [November 12, 2023, 7:05pm UTC](https://forum.dfinity.org/t/how-to-prevent-users-from-using-the-interface-badly/24608/4 "2023-11-12T19:05:42Z")

</div>

This is forum page? It doesn’t run on ICP.