CODEWITHSUNDEEP
javascriptapiauthenticationtokenmicroservices
Hamza
Hamza

Reputation: 1085

How to secure an API used only from front-end (Ajax call)

Well, I created an API to manage for our websites some attachments uploads and store into Amazon S3 buckets

The scenario : Once visitor / user in the form and wants to submit it with attachment, once the file is selected then button clicked an Ajax request fire to the micro service API so it can store the file into S3 do some processing then return the direct link or identifier.

The question is : how can we authenticate the user using for example a short live token or something like that without being hijacked, mis-usage of the token..

In Javascript everything is visible to the visitor, and we try to not integrate any heavy process in the backend

Upvotes: 1

Views: 711

Answers (1)

Akira
Akira

Reputation: 4071

If I got your question straight, you have a web interface in which files are uploaded to an S3 bucket and you need to make sure that in a certain back end API (such as REST) all file upload commands will have authentication and authorization.

The answer is highly dependent on your architecture but generally speaking, all Javascript calls are nothing but HTTP calls. So you need HTTP authentication/authorization. In general, the most straightforward method for REST over HTTP is the basic authentication, in which the client sends a credential in every single request. This may sound odd at first but it is quite standard since HTTP is supposed to be stateless.

So the short answer, at least for the scenario I just described, would be to ask the user to provide the credentials that Javascript will keep in the client side, then send basic authentication which the REST interface can understand. The server-side processes will then get such information and decide whether a certain file can be written in a certain S3 bucket.

Upvotes: 1

Related Questions