Timeline for How to restrict access to API in Azure API Management to known applications?
Current License: CC BY-SA 4.0
7 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jan 19 at 13:48 | vote | accept | TimTheEnchanter | ||
| Feb 11, 2021 at 11:30 | comment | added | TimTheEnchanter | Thanks, but we can't restrict based on userID or IP address (see above). All authenticated users could perform the operation if they're doing so from the known app. Unfortunately, I don't get to write the business rules...I'm just the lucky soul who gets to implement them... | |
| Feb 11, 2021 at 6:00 | comment | added | Clockwork-Muse | Note that you should never assume that one of your authorized client applications is the one making the call - your API should validate that the caller (that is, the AAD user) is authorized to call whatever operation and access whatever relevant data. At that point, whether or not it's an authorized application is quite possibly irrelevant, since it doesn't enable anything new. The authorized applications are then just for convenience. | |
| Feb 11, 2021 at 0:51 | comment | added | Conor Mancone | Welcome to the long, long, long line of questions asking (in essence) how to implement DRM. In short, you can make it harder, but you cannot make it impossible. You don't even need to be knowledgeable or need special tools to do this either - you can grab requests straight out of your browser's network tab and replay them however/wherever you want. | |
| Feb 11, 2021 at 0:49 | answer | added | ThoriumBR | timeline score: 1 | |
| Feb 10, 2021 at 19:35 | review | First posts | |||
| Feb 10, 2021 at 19:38 | |||||
| Feb 10, 2021 at 19:28 | history | asked | TimTheEnchanter | CC BY-SA 4.0 |