如果我的网站没有登录页面，如何设置 api 授权

Question

I want to set up authorization in my react app. This is for security reasons, so my API will only be accessed by the people who use our website. But my web app doesn't have a user login and doesn't require any. my backend uses rest api.

• How would I proceed with authorization with a token?
• How can I set up an initial token even before the page loads?

Answer 1

Something like a token will not work since it sounds like your app is public and therefore anyone could grab the token (being a browser based thing) and use that on their own. Instead I'd explore CORS to control the origin - for example only allowing your website to be authorized to perform the api call.. Here's an article on using CORS with the AWS API Gateway.

https://docs.aws.amazon.com/apigateway/latest/developerguide/how-to-cors.html