I'm looking for information to implement the following architecture:
- One Single Page Application hosted on AWS S3 + Cloudfront distribution - domain example.com
- A single API accessed by the single page application - domain api.example.com
- Every company has a dedicated DNS subdomain pointing to the Cloudfront distribution. For example, company A has dedicated subdomain companyA.example.com (implemented using a CNAME record)
- When a customer of company A accesses the domain companyA.example.com, its browser communicates with the API which MUST know that the customer came from this subdomain, therefore associating the customer to company A (remember, there is only one API)
- Of course, all communications are HTTPS
The following points are critical:
- The API MUST have a reliable way to know the subdomain "from" which the request has been sent - is the
Origin
header reliable? - Customers of company A cannot be forced to access subdomain of another company (customers stealing) - I guess this is more of a question of DNS protection
After exposing all this information, I think I can resume my question as:
How can the API know "for sure" the subdomain a customer came "from" ?