如何保护公共nodejs api仅对来自前端的请求

Question

I have a node frontend express server and a node api express server.

How can I best ensure that only requests that are made to the api are made from the frontend express server?

There is no user authentication so the user will not be sending a jwt with each request.

Answer 1

The easiest way would be to set the Content Security Policy using Helmet.js And you can easily add other security features using Helmet.

const helmet = require('helmet')

app.use(helmet.contentSecurityPolicy({
  directives: {
    defaultSrc: ["'self'"],
    // styleSrc probably not needed but you can set those too
    styleSrc: ["'self'", 'maxcdn.bootstrapcdn.com']
  }
}))

This effectively tells the browser “only load things that are from my own domain”

https://helmetjs.github.io/docs/csp/

https://github.com/helmetjs/helmet

Answer 2

in my opinions, you should

1. configure the firewall of api server to accept only ip address of the frontend express server with only port 443 also.
2. please add basic authentication to the header in every APIs, then the front-end must attach some username/password or secret to the header of all APIs calls.
3. in your server APIs, please include your security library, eg, helmet.js also. it can help you secure your APIs server.