I have an e-commerce website with a REST backend and a Single page JS as front end. I intend to secure my REST backend with OAuth2.
I don't want to oblige the user to authenticate when he first comes on the website, because as a e-commerce website, it is normal for the user to navigate to see the products, etc (maybe I am wrong...). So, on these 'public' pages, as I perform Ajax calls on by backend, is it worth to secure these URLs on my backend ? If not, what are the risks ?
Indeed, if I secure theses URLs on my backend, what can prevent any user to access these secured backend URLs by performing requests from the frontend ?
Maybe I am paranoid, but I think I should try to secure these URLs to prevent some attackers to use my backend for free or something else.
There would be no problem anymore for me if I oblige the user to authenticate. That's why I ask again if it is really the way to go for e-commerce...
Thank you very much.