I think you'll have to perform validation on both the server and client side since client-side measures alone won't fully prevent users from tampering with the coordinates. A hash-based message authentication code (HMAC) algorithm could help the server identify if the coordinates were modified.

This usually entails generating an HMAC signature on the server using a secret key, which the client cannot access, and then combining this with the coordinates and a unique identifier (like a nonce or timestamp). If a user intercepts the request and changes the coordinates, they won't have the secret key needed to generate the HMAC so the server can tell from the invalid HMAC that the coordinates have been altered.

Here's an article on implementing HMAC request signing: https://blog.andrewhoang.me/how-api-request-signing-works-and-how-to-implement-it-in-nodejs-2/