How can we securely implement a server action that requires passing userId as a parameter, considering the potential risks of unauthorized access through network requests?

For example
Edit Name with server action

we need to pass userId and newName to server action

but it can make a network POST request, so anyone can curl to our server action