如何仅从我们的网站服务器而不是访问者的 IP 向 API 执行 AJAX 请求？

Question

On our website we're using an AJAX request via jQuery to ping an API and retrieve the data when someone submits a form.

The API provider has told us that the AJAX request to their API must only come from one IP address, basically our webhost, and that currently anyone who visits the website to submit the form - that it's their IP making the ajax request, not our website.

Is there a way to make the AJAX call to the API directly from the website server itself, and not the visitor who submitted the form?

Here's the basic code we're using to some degree, it's just a simple AJAX request and the basic code is as follows (website redacted):

The API provider says this is making the call from the visitor's ip address, is there a way to do the same call but have it sent from our server ip?

$.ajax({
      url: 'http://website.com',
      dataType: 'json',
      success: function( data ) {
        // perform everything
    },
    error: function( data ) {
        // error stuff      
    }
  });
}

Answer 1

I don't know what framework or language you're using, so I'll try to be agnostic on that.

Instead of making the AJAX request to the API provider's server, you could create a resource on your own server that accepts AJAX requests and makes the necessary calls to the API from the server.

Answer 2

JavaScript is always run on the client. Any calls made through JS always originate from the client's machine. You can make calls to your own server (localhost on the domain the client is visiting) or another server, but the call will still originate from the client.

Let's try an example with 2 visitors to your site and a 3rd party site:

• Visitor 1 IP address = x
• Visitor 2 IP address = y
• Your website IP address = a
• Third party website IP address = b

Then you have the following connections:

• When visitor 1 makes an AJAX call to your website, x connects to a
• When visitor 2 makes an AJAX call to your website, y connects to a
• When visitor 1 makes an AJAX call to the third party website, x connects to b
• When visitor 2 makes an AJAX call to the third party website, y connects to b

What the third party site is telling you is only a is authorized to connect to b . x and y are not authorized to connect to b . Therefore you have to follow this sequence:

1. x or y connect to a
2. a connects to b (on behalf of x or y )
3. b responds to a
4. a responds to x or y

The question doesn't specify what your server runs, but languages like PHP can make calls to other servers using cURL.