0

We are designing a web site for selling financial products online.

The following is a high level description of the components:

  • Our frontend will be a SPA built with AngularJs.
  • The frontend will communicate with an API hosted in Heroku.
  • The API will expose web resources which allows the execution of the business process.
  • The API hosted in Heroku serve as a passthrough between the frontend and the real services which actually do the tasks.
  • The purchase process is designen to not ask for user/password or account creation at any point.

We have some queries we execute thru the API which returns confidential information -confidential according to the local law-

We want the frontend to authenticate to the API to retrieve this information still NOT asking for credentials to the user.

We thought about a local persistence of the credentials and obfuscating the request but that would be easy to break with a proxy so the request can be read clearly.

What would be an option for this need of authenticating the frontend without asking for credentials to our clients?

Improve this question
2
  • 1
    When you say you want to authenticate, but not ask username password, what do you mean? Do you want to ensure that the calls to your API happen only from the website, and not directly?
    – Narayana
    Feb 20, 2014 at 17:54
  • Yes sir. That's what we'd like to do. Not asking the final user for a user/password but not allowing (easily) third parties to execute the queries to the API thru http requests.
    – juanpavergara
    Feb 23, 2014 at 23:52

2 Answers 2

Reset to default
1

If your app is entirely client-side... then anyone who uses it can reverse-engineer anything it does. This is just part of what you get from not operating your own backend.

You're asking for a way to authenticate to the backend without authenticating. This is not possible.

Improve this answer
0

Do you want to ensure that the calls to your API happen only from the website, and not directly?

As you answer in your comments, this is what you want.

To make it short this is not possible, because request aren't from your website, they're always from the client's browser/computer, and if someone craft properly the headers you can't know.

Maybe using the DDOS protection that have some site could tightened the security and make it harder for crafted request to make it through, but I really don't know enough about that.

There are also capthas, and others methods to "proove" that you are humans. WHen someone proove it, you could give him a unique token that is passed in the requests.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .