Nodejs limit the API access to hosted web app

Question

I have a hosted admin panel under the domain admin.foo.com and the API hosted under the domain api.foo.com

I have an open endpoint GET - api.foo.com/all-products. There is no authentication header required to access this resource. But this should be accessed only via the hosted web app.

The user should not be able to copy this url and paste on the web browser and see the json response and also user should not be able the data from this endpoint via another API or something.

This question is already asked in StackOverflow but the given answer is this is not possible due to powerful tools like postmon. But this should be able to achieve to at least for some extent using Node.js and express.js features.

Say check where the request is coming from and then block the resource something like that. How do I achieve this using Node.js, Express.js?

user_14761365 · Answer

What you are looking for is cors

const cors = require('cors');
app.use(cors({
    origin: 'https://admin.foo.com'
}));

More info: https://www.section.io/engineering-education/how-to-use-cors-in-nodejs-with-express/

Nodejs limit the API access to hosted web app

1 Answers