React proxy how to prevent from outside world

user_16475710 0
Viewed 89

I have a react js application working on port 3000 and a nodejs working on port 4000. I am using setupProxy as

const createProxyMiddleware = require(`http-proxy-middleware`)
module.exports = function (app) {app.use('/api/*', createProxyMiddleware({ target:http://localhost:4000', changeOrigin: true, }))}

On server, running on port 4000, I am using cors as:

app.use(cors((cors.CorsOptions = { origin: `http://localhost:3000`,})))

The application on localhost:3000 is exposed as https://example.com/ I have an end point on Node server as /api/todos which perfectly accessible from react client.

Outside world can post for example https://example.com/api/todos. How to prevent this?

reactjs node.js proxy
1 Answers

There was a similar post I answered a few days ago here

How to launch a command on the server from a web page ( nodejs )

With that being said though, and maybe a TLDR you need a way to protect your route. This is where you have two options really.

  1. Use JWT
  2. Use 'sessions' (this would assume you are not connecting / posting from outside the main application so it shares a session between frontend / backend)

From what it sounds like, the application / front-end are not bound together so option 2 may not be an options.

With option one you would create a JWT token from the front end. This token would contain an encoded string that can only be decoded on the server. You send this token with your post or get request and have middleware to decode and verify the token is valid, if not, don't let it post to the route.

user_17175730
Related