0

I am build a website in Angular which communicates over my REST API on my backend server.

I have managed to auto-generate the code (TypeScript) for my client and now I need it to be available on deployment.

There are several ways to do this and the, in my oppinion, easiest way would be to just publish the client to https://npmjs.org/ and then let everything be installed on deployment from there. Business as usual.

The question is:

Is this a good idea?

Obviously, there's nothing that really can happen, because every client needs a client id and password in order to get dealt with by my server.

But: With this I am simply exposing all endpoints to my backend.

Wouldn't I do a favor to anybody who want to sniff my API? Surely, there must be ways to get that information another way but at least not that easy.

Are my concerns legitimate or basically nonsense?

Improve this question
4
  • Who would be doing the installing? Novice end-users or engineers from your company? I believe the company I worked for had a some kind of private repository: not sure whether it was with NPMJS or a 3rd party, nor how complicated it was to download from that instead of the default, but might be something to look at.
    – TripeHound
    Commented Jan 21, 2020 at 15:45
  • @TripeHound The build process of my server installs it. It's a dependency of my client and would get installed just like other dependencies through npm install during the build.
    – Stefan Falk
    Commented Jan 21, 2020 at 16:02
  • Are you building an SDK for them to use in their own application, or an actual standalone application itself? Because the former makes sense for npm, but the latter does not... It might work, but it is really not what npm was designed for.
    – Conor Mancone
    Commented Feb 20, 2020 at 22:05
  • Have you considered using private NPM packages?
    – le3th4x0rbot
    Commented Feb 20, 2020 at 23:59

1 Answer 1

Reset to default
1

If you are providing a public API already, the security concern should be focused with the server side endpoints and not the client.

Yes, providing a public client to your API will allow any one to investigate your API, but anyone can already do that. The API will just make it easier to determine what endpoints exist and how they are used.

If you are concerned with the security of your API, you should focus your attentions there first. Providing a public client for the API doesn't increase your attack surface.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .