REST API request authentication

Question

I've been trying out the whole MEAN concept of having a REST API for your front-end to access and so on and so forth.

How do I verify that the request to my API is from an ongoing session? Any "token" that I may have the Angular section send in every request for authentication, can be viewed by any person curious enough to look for it.

Said person can take that token and issue "authenticated" requests to the API until the cows come home. How do you get around this?

ie, I wouldn't like someone with a token use the API to get access to information that may be sensitive to a user etc

Answer 1

您可以使用多种机制，例如 CSRF 和 CORS 来确保请求来自给定的域名（即您自己的网站）