Protection of API against direct access

Admin 1
Viewed 111

I have separate backend and frontend. However, they run on the same server (this may change in the future). The backend serves as an api and is powered by Laravel. Frontend by Nuxt (Vue).

I wish only my Nuxt application could access the api. How can I configure Laravel to only return data if the request comes from a Nuxt application?

I thought about adding a special token to requests, but the user will be able to check what request is coming out and capture the token. Can anyone give me ideas how this can be solved?

nuxt.js laravel vue.js
2 Answers

You must be knowing about CORS. So in your Laravel Server, allow requests from only the frontend server's domain like this:

Access-Control-Allow-Origin: https://www.example.com
user_73099880

Simplest solution would be to add serverMiddleware in the nuxt project and route all the requests to the "real" api through it. Clients will hit the internal nuxt api and they will not be able to see the actual request made to the real api. There you can also add the token you are talking about for extra layer of security.

user_51521470
Related