在node.js API端点中禁止直接URL访问

Question

I have an api endpoint but I want it to be access only from a certain website.

The api is from api.mydomain.com/v1/ And the website that can only access that api is mydomain.com . I already implemented CORS, but since my website can be access by public, no need for login, also it is static and the api is called by ajax, i did not added token. If the user will view-source my site they will see the api endpoint. So if they browse the endpoint, they can access the data directly. I want the url end point to be access by my domain and not by directly accessing it. How can I do it in node.js express project?

Answer 1

看起来你需要添加某种CSRF保护，其中所有的API请求只取得由mydomain.com网页将包含一些安全令牌（您或您使用的应该提供这个安全令牌的执行框架）本SO帖子可能会帮助进一步