I have an API in Node JS with mostly GET endpoints and a client side single page application.

The application is meant to be open without the need to authenticate, i.e like booking.com where you can browse hotels without the need to login or register.

Anyone can hit my endpoints and get raw JSON data or even make an app that utilize my endpoints in their own app.

How can I secure my endpoint? For example with a token based or any other signature to trust my client app only.

  • 1
    This is some what confusing because first you state that no authentication is required and your question is how to protect other apps from accessing your end points. You basically answered your own question, use API key(s) (which is more authorization than authentication) – Jeroen Jun 5 '18 at 12:36
  • i understand authentication but how would i do without a user id, i basically need a way to authenticate the app not a user, i hope that someone can understand what i mean because i don't know how should i describe it. – Ibrahim Mohammed Jun 5 '18 at 12:41
  • Are you making API calls from server side in client app? If you are, you could implement API key that your client app sends in requests to API. Basically your own client app would authenticate to API. In case client calls API directly then it’s more tricky as client side would have to have access to key. – MKT Jun 5 '18 at 13:37
  • To clarify, your goal is strictly "prevent access to the API through means other than the website" not anything like "protecting users from each other"? – Kamil Drakari Jun 5 '18 at 18:30
  • @KamilDrakari yes exactly, i don't have any user related data to protect, the website is just open information provider for everyone, i just need to secure its resources – Ibrahim Mohammed Jun 5 '18 at 18:35

You cannot secure any secret that is public. If the HTML page sent to the client have the API keys, they are not secret anymore. Anyone can read the page and grab the key, and use it as they want.

Don't even think about encoding, obfuscating or encrypting it client-side either. The developer tools on any modern browser will let the user see the actual request, and they will just grab the keys on the request. Even if the application is a binary with encryption and anti-tamper, and uses SSL with certificate pining, a determined user will grab the keys. It can take seconds or days, but the key will leak.

To protect the keys, use a proxy. Make a server side component that holds the keys and access the backend, and your HTML page (or app, or Java, or whatever client application) will access it.

And you cannot really know if the client connecting is your client. Even MMO game producers have trouble dealing with alternative clients used to bypass some protections. You can only make it harder, but again, a determined attacker can bypass your protections.

  • what about using client certificate authentication – Ibrahim Mohammed Jun 5 '18 at 18:20
  • 1
    Attacker downloads client, extracts certificate, you lose. – ThoriumBR Jun 5 '18 at 23:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.