How to whitelist one GAE service on another within the same project Node.js

Question

I have two servers. The first is a backend using Apollo Server, and the other is my frontend server using Next.js

The backend is hosted at api.example.com, and the frontend is hosted at www.example.com . Both servers are running on Google App Engine as two different services in the same app.

The problem I've run into is that I have used graphql-query-complexity to apply rate limiting to my application, and it is also rate limiting my frontend server because the frontend server is using server-side rendering to preload the request data.

My question is this: How can I whitelist my frontend server so that it can make as many requests as it needs, without having to manually update an environment variable with the server IP address everytime I push new code to production on the frontend server? I also am unsure if my frontends requests to the backend are using the local network or if they are using www?

Here is the code related to rate limiting my server:

if (config.NODE_ENV !== 'test') {
        // If the cost of the query is more than 500 throw an error
        if (cost > 500) {
          throw new Error(`Query cost exceeds single request token limit. The limit is 500 tokens and the query has a cost of ${cost} tokens. Please reduce the query cost and try again.`);
        }

        // Ensure that the IP Address is present on the request
        if (context && context.req && context.req.connection && context.req.connection.remoteAddress && context.req.connection.remoteAddress !== ---- not sure what to do about this ----) {
          // Check if there is a token allotment already in the database for that IP Address
          const tokens = await redis.get(context.req.connection.remoteAddress);

          console.log(tokens, cost);

          if (tokens !== null) {
            // If the request would exceed the token allotment
            if (tokens - cost < 0) {
              throw new Error('This request would exceed your token allotment. Please reduce the query cost or wait one minute and try again.');
            }
            // Decrement the token allotmetment by the cost of the query
            await redis.decrby(context.req.connection.remoteAddress, cost);
          } else {
            // Set the value and time-to-live of the token allotment
            await redis.setex(context.req.connection.remoteAddress, 60, 5000 - cost);
          }
        } else {
          throw new Error('An error occured within the request cost calculator. Please try again.');
        }
      }

Answer 1

You can check for the header X-Appengine-Inbound-Appid . App engine automatically adds it when you issue http requests between your services/projects (NOTE: you have to send the requests to that service's appspot.com url).

https://cloud.google.com/appengine/docs/standard/python/appidentity/#asserting_identity_to_other_app_engine_apps