We are in a process to expose some data (not sensitive) via REST APIs. Our API consumer requested the same using only API Key authentication. No Mutual Authentication TLS, no OAuth but plain simple API Key based authentication.
I would like to get some inputs to understand what are the different precautions we should consider to host such APIs as provider.
Consumer have their interface exposed as browser based client (web page) & they would like to call the APIs directly from client side browser app (not from web server). I heard it is existing pattern & if data is not sensitive it can be supported. But I like to make sure that all possible precautions from security perspective has been taken.
Access-Control-Allow-Origin: *
in response to any CORS request (so web browsers can request the information from arbitrary pages without running into same-origin policy), and call it a day. That is, of course, assuming that the data is truly not sensitive (i.e., completely public, not specific to any user or in any way private).