I have a REST API that can potentially serve multiple web clients.

I want to ensure that only my single page app on my-one-and-only-web-cleint.com can make requests to my API. How do I do this?

Right now there isn't much to stop someone from copying the source of my website and act as a copy of my single page app on my-one-and-only-web-cleint.com.

Only check I have right now is:

  • On server side: I check for request header's origin and only allow requests from my-one-and-only-web-cleint.com

But my understanding is that you can manually change the header, so this check can be bypassed.


This sounds like preventing a CSRF attack. The Same Origin Policy will already prevent anything within your API from being read by another domain, but to prevent requests that makes changes to your system you will need to guard against CSRF.

On server side: I check for request header's origin and only allow requests from my-one-and-only-web-cleint.com

Checking the Origin header or a custom one such as X-Requested-With is a valid way to beat CSRF.

An attacker cannot forge this header in the web browser, so anyone connecting to the attacker's site which he has connected to your API will not be able to use it as their browser header cannot be tampered with.

You should also rely on an authorisation system to prevent the attacker from making API requests server side (where they can set any header they want).

  • Thank you. What authorization system can I be using for this purpose? Jul 27 '14 at 18:35
  • @gar by that I meant protect your app by a user name and password for each user of your system . Jul 27 '14 at 18:40
  • @SilverlightFox - I think the CSRF token would just ensure that other tabs not pointing to his app(so not using his client) can't make the request. But I can imagine that a authenticated user could get a CSRF token and then use it in a malicious client(for what reasons, that's another question) to make requests. May 7 '16 at 6:47
  • 1
    @nick Yes, that's true. However, with authentication you will then know the accounts which are doing this to throttle or block them, either automatically based on a request limit, or manually. May 7 '16 at 12:09
  • 1
    @SilverlightFox But the question was "How to ensure only my SPA can access the API". I don't see how SOP or a CSRF token ensures I cannot connect to the API outside of a browser.
    – tcurdt
    Jan 25 '20 at 19:02

It sounds like a situation similar to CSRF attacks, so it should be addressable with anti-forgery tokens.

Anti-forgery tokens should achieve what you need. Each time you get a web request, you serve an anti-forgery token to the client as part of the FORM or script or webapp. The token embeds values like a date, login id, and client ip, encrypted with a secret key only known to your server. Then you only handle requests that include valid tokens.

A middle man can't modify your site and host its API on theirs, because they won't be able to serve valid tokens.

Here's more info on how to do this in ASP.NET, but the same applies in other languages.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.