I am building an application that stores form entries. It will accept post requests from a client web application and store the information as defined in the request. For example,
frontend.com makes a request to
backend.com/form-entries/create. My question is what's the best practice for securing
backend.com so that it only accepts requests from authorized clients? We can assume that
backend.com will only serve a handful of front-end clients that are owned by me.
It seems to me that the most simple and secure way of doing this would be to assert that incoming requests be from authorized domains, such as
frontend.com. These authorized domains could be stored in the database. Am I correct in this thinking?