CODEWITHSUNDEEP
flask
Vishah
Vishah

Reputation: 45

Securing an API from other web apps

I have a react web application with a flask api (I used to use express). The product of this app is the data that it displays. I don't want other people to be able to take that data easily from calling the api.

I want to secure the api such that it can only be accessed by my react app and nothing else. How can I do that?

Upvotes: 0

Views: 45

Answers (2)

Kasey Chang
Kasey Chang

Reputation: 542

The only way to truly secure your API is by authenticating your app's user with something like Oauth2 and verify that credential on server-side with something like passport, and make the authorization expire with sessions. AND use SSL so none of that is easily visible through a protocol analyzer.

Sure, you can hard-code some sort of "secret key" with the app, but anyone who want it bad enough will read it off your app or sniff the packets through a packet logger until they find the key.

EDIT: Oh, and as a part of the authorization upon login, provide them with a uniquely generated "API-KEY" as part of identity, so you can validate them upon submission, and if they violate your trust, mark their API key invalid in the server so they can't use them any more.

Upvotes: 2

Ross Hunter
Ross Hunter

Reputation: 141

First, if your client code and API server are running on different domains or ports, configure CORS on your API server to only honor requests that originate from the client code's domain. Second, authenticate legitimate users so that only authorized requests for data are honored. There are lots of 3rd-party libraries to help with authentication.

Upvotes: 1

Related Questions