CODEWITHSUNDEEP
node.jsreact-nativeapirestexpress
blouuuu
blouuuu

Reputation: 544

How to secure an ExpressJS RESTful API?

I was wondering if it is possible to secure an expressjs RESTful API that only a react native app and react website could access.

For exemple my server is running on port 8000, my react native app is on port 3000 and my website on port 5000. I want the server to listen only to requests coming from these ports.

Let's say I have a POST route to mydomain.com/signup I don't want users to make that post request using external websites or tools like Postman.

What would be the best way to ensure my mobile app and Web site are the only ones allowed to access my RESTful routes.

Upvotes: 1

Views: 83

Answers (1)

jfriend00
jfriend00

Reputation: 707228

First off, you are a bit mistaken about how a request to your API works. When your react app on port 3000 makes a request to your server on port 8000, it's just a random incoming request. It doesn't "come" from port 3000. In fact, the incoming port number with be some randomly generated port with 5 or 6 digits. Outbound ports are dynamically generated by the TCP system and you can't tell what "app" it came from.

Second off, your RESTful API server is just a server on the internet. Anyone can make a request to it. Using cross origin protections, you can provide some limits about what can be done from browser Javascript (only allowing requests from your particular domain's web pages), but other requests (not from a browser) cannot be blocked this way.

So, any code jockey using any tool other than a browser can write code to your API. What someone like Google does is they require you to either have an APIKey that they issued to you or they require some login credentials (often a cookie from a previous end-user login) that identifies the user making the request as a permitted user using their system. Even with these tools, this just means that a permitted user is accessing the API, it does not mean that only your app is accessing the API. And, in fact, you can't really prevent that.

So, what most people do is they require a login or APIKey credential and they track the type of use of the API. If the use of the API seems appropriate (particularly the types and frequency of requests), then that use is permitted. If the use of the API does not seem appropriate (often too many requests over some period of time), then that particular credential or user may be blocked from accessing the service either temporarily or permanently.

Let's say I have a POST route to mydomain.com/signup I don't want users to make that post request using external websites or tools like Postman.

You cannot effectively do this. There are obstacles you can erect to make it more difficult like putting an expiring token in your web page and having your own use of the API include the token and then detecting if its a valid token, but a determined hacker will just scrape the token from the web page and still access your API using it from whatever programming tool they want.

What would be the best way to ensure my mobile app and Web site are the only ones allowed to access my RESTful routes.

You can't. Your API is on the web. Anyone with whatever credentials you require can access it.

Upvotes: 2

Related Questions