I have REST APIs which are behind a webserver, then there is a custom single page application frontend hosted on it (React). It goes like that:
- The user logs to the index page, if the session cookie is not present they gets redirected towards the login page
- The user logs and gets redirected to the index: all the requests will have this session cookie
- The custom frontend sends, along to every request, some custom header, say "X-FRONTEND: <app name>"
- The webserver will block each request not having the session cookie
- The APIs will block each request not having neither the cookie and the (fixed) header
- The server has CORS configurations so that accepts only requests coming from the same domain
I tried hypothesizing a couple of scenarios:
- GET call hidden in a page. It will get blocked as the requests will not have the custom header
What do you think about it?