CODEWITHSUNDEEP
oauth-2.0asp.net-web-api2single-page-application
marvelTracker
marvelTracker

Reputation: 4969

Securing Api Calls without OAuth2 client credentials flow in a SPA application

I've got a SPA application which gives statistics and information to anonymous users. It is a react spa app and will consume backend REST Web API(.net core). These data are not specific to users, therefore the information is freely available and no user authentication is required. However, I don't want my Backend Api layer to be exposed to the internet (i.e not use by anonymous applications such as postman, rest clients, etc). I'm familiar with the Client credential flow (OAuth) but I can't use it for this application because there is no concept for user login in this application.

What would be my best options that limit access to my API layer to anonymous applications (i.e postman, etc), or is it not possible at all?

Upvotes: 1

Views: 1134

Answers (2)

Trey Griffith
Trey Griffith

Reputation: 509

It's not possible to make an API accessible to a public client (your SPA) without also making it accessible to users making API calls from Postman or custom code. It's possible to do the reverse, only because of the limitations that browsers put in place.

Depending on what you're trying to achieve, you could use something like reCAPTCHA to validate that the users of your API are humans, not scripts. That along with human-scale rate limiting would probably filter out most of non-app users.

Upvotes: 0

MvdD
MvdD

Reputation: 23436

You can't use client credentials flow for your SPA. Anyone would be able to download your SPA, extract the client id and secret and use it to call your API.

If you do not want to authenticate your users, there's no good way to protect your API. Move your SPA to a traditional web application hosted on a server to protect it using client credentials flow.

Upvotes: 2

Related Questions