Nodejs 限制 API 访问托管的 web 应用程序

Question

I have a hosted admin panel under the domain admin.foo.com and the API hosted under the domain api.foo.com

I have an open endpoint GET - api.foo.com/all-products . There is no authentication header required to access this resource. But this should be accessed only via the hosted web app.

The user should not be able to copy this url and paste on the web browser and see the json response and also user should not be able the data from this endpoint via another API or something.

This question is already asked in StackOverflow but the given answer is this is not possible due to powerful tools like postmon. But this should be able to achieve to at least for some extent using Node.js and express.js features.

Say check where the request is coming from and then block the resource something like that. How do I achieve this using Node.js, Express.js?

Answer 1

What you are looking for is cors

const cors = require('cors');
app.use(cors({
    origin: 'https://admin.foo.com'
}));

More info: https://www.section.io/engineering-education/how-to-use-cors-in-nodejs-with-express/