I want to utilise Nuxt's serverMiddleware to handle API calls from an SSR Nuxt application. There are essentially 2 options for doing so:
- Implement the full API in
serverMiddleware - Implement the full API as a standalone service, and 'proxy' calls to it via
serverMiddleware
In either case I want API calls to be authorised solely for the Nuxt application front-end. There is not a user login system, but I do not want any routes exposed by serverMiddleware to be callable from anywhere other than the host running them.
In the second instance, even if my standalone API is fully internal and any secrets are contained within serverMiddleware - simply calling the serverMiddleware routes exposed by Nuxt would essentially give access to the internal API.
So the tl;dr: - how can I sufficiently lockdown serverMiddleware routes such that they only accessible by the Nuxt application running on the same host?