Serve REST-API data in web-page without exposing API-endpoint

Question

I am beginner in MEAN stack.

When invoking unauthenticated REST API (no user log-in required), API end-points are exposed in the JS files. Looked through forums that, there is no way to prevent abusers using the API end-point directly or even creating their own web/app using those end-points. So my question is, are there any way to avoid exposing the end-points in the JS files?

On a similar note, are there any ways, not to use REST calls on front-end and still be able to serve those dynamic content/API output data in a MEAN stack? I use EJS.

Answer 1

There's no truly secure way to do this. You can render the page on the server instead, so the client only sees HTML (and some limited JS).

First, if you don't enable CORS, your AJAX calls are protected by the browser, ie only pages served from domain A can make AJAX calls to domain A.

Public API providers like Google Maps protect themselves by making you use an API key that they link to a Google account. That key is still visible in the JS, but - if abused - can be easily disabled.

There's also pseudo-security through obfuscation, ie make it harder for an attacker to extract a common secret you are using the encrypt the API interaction.

Tools like http://javascript2img.com/ are far from perfect, but makes attackers spend a lot of time trying to figure out what your code does. Often that is enough.

There are also various ways to download JS code on demand which can then check if the DOM it runs in is yours.