Limit API only to main application
Unanswered
British Shorthair posted this in #help-forum
British ShorthairOP
Hello everyone, how can I make some routes only available to the main app, while some others to all website. Please use middleware if possible, if not, no problem.
10 Replies
@British Shorthair Hello everyone, how can I make some routes only available to the main app, while some others to all website. Please use middleware if possible, if not, no problem.
that is impossible, you can always include some kind of secret in reqs from your site and check that secret and handle accordingly.
British ShorthairOP
What about CORS
Or does that not fix the problem
@British Shorthair Hello everyone, how can I make some routes only available to the main app, while some others to all website. Please use middleware if possible, if not, no problem.
check this message and the discussion above it which discusses this exact question https://discord.com/channels/752553802359505017/752647196419031042/1124318101509509260
British ShorthairOP
Ok thanks
tldr it is impossible; with CORS you only prevent fetches from the browser, but fetches from curl or nodejs are still possible <- but this can be mitigated by rate limit
British ShorthairOP
I can still fetch from the browser
Even with CORS
that means you configured CORS incorrectly
if CORS is configured correctly, something like this should appear in the browser (unless you explicitly disabled CORS checking in your browser e.g. by using a browser extension)