节点JS | 英雄联盟 | MongoDB 地图集 | 如何确保只有我的应用程序可以访问我的后端？

Question

I've built my backend using MongoDB Atlas, Express, and Node JS and deployed it to Heroku. Using Postman, the app is operating properly so far (users are getting added and I'm receiving the json web token correctly).

But I'm thinking that this might not be correct because it seems like anyone with access to my Heroku URL and routes can easily create a new user, receive the json web token, and basically operate their entire app using my backend.

My questions are:

1. Am I missing something huge about how I've built my backend?
2. How do I go about securing my backend so that only my apps can access the backend?

Answer 1

You can use Passportjs to protect your routes, passport will be your middleman between person accessing the back-end and your actual back-end.

You can give access to the routes if a valid JWT is passed ( JWT strategy ) otherwise it will throw 401 (Unauthorized).

There are 400+ strategies available, I will recommend JWT one because you are already generating JWT.

Protecting backed is integral part because most of scripts can disable security on front-end leaving apps vulnerable to attacks.