0

I'm looking for information to implement the following architecture:

  • One Single Page Application hosted on AWS S3 + Cloudfront distribution - domain example.com
  • A single API accessed by the single page application - domain api.example.com
  • Every company has a dedicated DNS subdomain pointing to the Cloudfront distribution. For example, company A has dedicated subdomain companyA.example.com (implemented using a CNAME record)
  • When a customer of company A accesses the domain companyA.example.com, its browser communicates with the API which MUST know that the customer came from this subdomain, therefore associating the customer to company A (remember, there is only one API)
  • Of course, all communications are HTTPS

The following points are critical:

  • The API MUST have a reliable way to know the subdomain "from" which the request has been sent - is the Origin header reliable?
  • Customers of company A cannot be forced to access subdomain of another company (customers stealing) - I guess this is more of a question of DNS protection

After exposing all this information, I think I can resume my question as:

How can the API know "for sure" the subdomain a customer came "from" ?

2
  • 1
    It is not really clear what your question is. One thing though: We don't design solutions. Instead, if you have trouble implementing the one you designed, ask a specific question about that problem.
    – Sven
    Jan 26, 2019 at 20:23
  • I introduced with information that helps understand the question that I asked at the end of the post.
    – manash
    Jan 26, 2019 at 20:26

0

You must log in to answer this question.

Browse other questions tagged .