0

I am build a website in Angular which communicates over my REST API on my backend server.

I have managed to auto-generate the code (TypeScript) for my client and now I need it to be available on deployment.

There are several ways to do this and the, in my oppinion, easiest way would be to just publish the client to https://npmjs.org/ and then let everything be installed on deployment from there. Business as usual.

The question is:

Is this a good idea?

Obviously, there's nothing that really can happen, because every client needs a client id and password in order to get dealt with by my server.

But: With this I am simply exposing all endpoints to my backend.

Wouldn't I do a favor to anybody who want to sniff my API? Surely, there must be ways to get that information another way but at least not that easy.

Are my concerns legitimate or basically nonsense?

4
  • Who would be doing the installing? Novice end-users or engineers from your company? I believe the company I worked for had a some kind of private repository: not sure whether it was with NPMJS or a 3rd party, nor how complicated it was to download from that instead of the default, but might be something to look at.
    – TripeHound
    Jan 21, 2020 at 15:45
  • @TripeHound The build process of my server installs it. It's a dependency of my client and would get installed just like other dependencies through npm install during the build. Jan 21, 2020 at 16:02
  • Are you building an SDK for them to use in their own application, or an actual standalone application itself? Because the former makes sense for npm, but the latter does not... It might work, but it is really not what npm was designed for. Feb 20, 2020 at 22:05
  • Have you considered using private NPM packages? Feb 20, 2020 at 23:59

2 Answers 2

1

If you are providing a public API already, the security concern should be focused with the server side endpoints and not the client.

Yes, providing a public client to your API will allow any one to investigate your API, but anyone can already do that. The API will just make it easier to determine what endpoints exist and how they are used.

If you are concerned with the security of your API, you should focus your attentions there first. Providing a public client for the API doesn't increase your attack surface.

0

I am build a website in Angular which communicates over my REST API on my backend server.

I have managed to auto-generate the code (TypeScript) for my client and now I need it to be available on deployment.

It sounds like this is a public website, and the code in question is already going to be sent to the browser anyways. Things like magnification make reading the code harder, there may even be obfuscation libraries, but neither of these techniques will protect particularly juicy secrets about your back end. In other words, the library already needs to contain no secrets.

You mention auto-generated code, it is probably safe to assume this library will not have any intellectual property value. Assuming it did, providing non-obfuscated code makes it easier to fork/copy.

If the website is actually password protected or hidden within a restricted network, publishing parts of the client code does reveal information which might not otherwise be available. From the perspective of hacking your API services it should have no value, but it will definitely reveal things about what your internal website does... which might be business secrets.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.