How to restrict the upstream APIs to a particular url #1887
-
|
React App calls our API and need to make sure we restrict the upstream APIs only to this React app only. Note that both the React app and the API are on the same domain with different urls. Was looking for options to restrict calls using Origin or other request headers but seems it can be spoofed. Tried UpstreamHost but it did not help. Not sure if this is possible. Appreciate help. |
Beta Was this translation helpful? Give feedback.
Replies: 1 comment
-
|
Hi! Why not to define authentication route? |
Beta Was this translation helpful? Give feedback.
Hi! Why not to define authentication route?
Your React app could sign simple jwt-token with custom claim, with custom header name, with short expiration time (<= Timeout).
Then, authenticate, then transform claim to a static header if API is private. If it's public, I recommend to close API turning it to authorized with a short jwt-token from React app.
Pay attention, your React app plays the role of identity server generating all auth-tokens for all apps in your workflow.
Hope it helps!