I have a system with three layers: two client web apps, one Backend, and two DBs.
The two DB and client app instances represent prod and test environments.
The backend has only one instance that should serve both environments. Say I have
test-db.myapp.com but only one API service
The backend exposes one API, but it should match the client app and the DB environment. My current implementation is to send the environment code
test from the client app to the backend so it will know which DB to query.
Duplicating the backend for each environment is not an option.
But I'm wondering if sending the environment code from the client app is a good idea... Is there some security risk with that approach?