Otdfbt

My advisor talks about me to his colleague

Proving n+1 th differential as zero given lower differentials are 0

Why does sound not move through a wall?

Emotional immaturity of comic-book version of superhero Shazam

How long would it take for people to notice a mass disappearance?

Is there an official reason for not adding a post-credits scene?

Manager is threatening to grade me poorly if I don't complete the project

How do LIGO and VIRGO know that a gravitational wave has its origin in a neutron star or a black hole?

Upside-Down Pyramid Addition...REVERSED!

Adjacent DEM color matching in QGIS

Are pressure-treated posts that have been submerged for a few days ruined?

Nominativ or Akkusativ

Do publishers care if submitted work has already been copyrighted?

Copy previous line to current line from text file

Appropriate certificate to ask for a fibre installation (ANSI/TIA-568.3-D?)

How can I get people to remember my character's gender?

Would you use "llamarse" for an animal's name?

What are the advantages of luxury car brands like Acura/Lexus over their sibling non-luxury brands Honda/Toyota?

What does "Managed by Windows" do in the Power options for network connection?

What is the solution to this metapuzzle from a university puzzling column?

Something that can be activated/enabled

Where can I go to avoid planes overhead?

Would glacier 'trees' be plausible?

Is bounce rate of a website a ranking factor?

Securing authenticated API calls with NGINX reverse proxy

How to set up Nginx as a caching reverse proxy?Nginx reverse proxy + URL rewriteGo(lang) with nginx - Serving Static Filesnginx proxy with CASSecuring Kafka REST API endpointsWhy does my nginx proxy fail, but my node.js proxy works?How do I ensuring cache consistency between two Nginx edgesOverwrite HTTP headers comming back from a web application server proxied in nginxMy Web application gives CORS error after adding HTTPS using Let's EncryptNginx preventing cookie from being sent from front to back end

.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty height:90px;width:728px;box-sizing:border-box;

1

First of all , apologies for being an Nginx newb. We utilize third-party API's that require authentication and we want to secure the API key by setting up a reverse proxy in Nginx. I'm pretty sure I get how to set up this part - create a location, proxy_pass it to the third-party server and add in authentication headers.

However, even though the API key is secure, at this point any user has full access to the API through the front-end URL, is that right? How I would I limit access to the proxied API to requests coming from the web server itself? Is adding a CORS header the correct solution here?

Part of my confusion is I'm not sure what is the 'origin' of a AJAX request in front-end code? Does it count as coming from the web server or from the user's computer, since code is executed in their browser?

nginx reverse-proxy

share|improve this question

asked Apr 25 at 9:01

T NguyenT Nguyen

1062

add a comment | 

1

First of all , apologies for being an Nginx newb. We utilize third-party API's that require authentication and we want to secure the API key by setting up a reverse proxy in Nginx. I'm pretty sure I get how to set up this part - create a location, proxy_pass it to the third-party server and add in authentication headers.

However, even though the API key is secure, at this point any user has full access to the API through the front-end URL, is that right? How I would I limit access to the proxied API to requests coming from the web server itself? Is adding a CORS header the correct solution here?

Part of my confusion is I'm not sure what is the 'origin' of a AJAX request in front-end code? Does it count as coming from the web server or from the user's computer, since code is executed in their browser?

nginx reverse-proxy

share|improve this question

asked Apr 25 at 9:01

T NguyenT Nguyen

1062

add a comment | 

First of all , apologies for being an Nginx newb. We utilize third-party API's that require authentication and we want to secure the API key by setting up a reverse proxy in Nginx. I'm pretty sure I get how to set up this part - create a location, proxy_pass it to the third-party server and add in authentication headers.

However, even though the API key is secure, at this point any user has full access to the API through the front-end URL, is that right? How I would I limit access to the proxied API to requests coming from the web server itself? Is adding a CORS header the correct solution here?

Part of my confusion is I'm not sure what is the 'origin' of a AJAX request in front-end code? Does it count as coming from the web server or from the user's computer, since code is executed in their browser?

nginx reverse-proxy

share|improve this question

asked Apr 25 at 9:01

T NguyenT Nguyen

1062

share|improve this question

asked Apr 25 at 9:01

T NguyenT Nguyen

1062

share|improve this question

asked Apr 25 at 9:01

T NguyenT Nguyen

1062

asked Apr 25 at 9:01

T NguyenT Nguyen

1062

asked Apr 25 at 9:01

T NguyenT Nguyen

1062