如何使用 Express.js 限制 API 仅访问授权域？

Question

I'm working on a layer of security for my Node.js/Express.js app where I would like restrict access to an authlist (authorized list) of domains.

NB The opposite of an authlist is a denylist .

The Rundown:

• Users create a Project on my system.
• Each Project is issued a Public Key and Secret Key that will be used to create signed requests.
• Additionally, the admin of any given Project will need to supply a authlist of domains that they'd like to be able to access the API for that given Project . This is done in the web-based console, not as part of every request.
• When the API receives a request, req.get('origin') is used to determine the origin domain of the request.
• The origin is checked against the authlist and either allowed or denied accordingly.

In Code :

var app = require('express');

app.post('/my-api-endpoint', function(req,res) {

    var originDomain = req.get('origin');   /// e.g. mysite.com
    /// Origin is then checked against the authlist array of domains

});

The Questions

• What concerns do I need to be aware of with regard to Domain Origin Spoofing?
• Is this a worthy security feature at all? Or is it so easily spoofed that there's no point in bothering?

Answer 1

The best way to accomplish what you are looking for is to forget domains all-together and optionally allow the whitelisting of IP ranges. With that said, some of the biggest APIs in the world do not even use this security layer (ie eBay, Amazon's Marketplace, etc...).

In the interest in addressing the extra paranoia though, you could have your clients set up subnets to launch their autoscaling servers into which would give them a static range of IPs to whitelist. Then only servers inside this IP range would be given permission to access your endpoints.

Here is a question on AWS that explains a tad more about that: https://forums.aws.amazon.com/thread.jspa?threadID=233469

Answer 2

Its is possible to use the middleware feature to use something like you did in the question example, but origin, til I know, is somethins the only browser feature, so it's possible to user a proxy to mask it and easely pass througth this kind of filter