First of all , apologies for being an Nginx newb. We utilize third-party API's that require authentication and we want to secure the API key by setting up a reverse proxy in Nginx. I'm pretty sure I get how to set up this part - create a location, proxy_pass it to the third-party server and add in authentication headers.

However, even though the API key is secure, at this point any user has full access to the API through the front-end URL, is that right? How I would I limit access to the proxied API to requests coming from the web server itself? Is adding a CORS header the correct solution here?

Part of my confusion is I'm not sure what is the 'origin' of a AJAX request in front-end code? Does it count as coming from the web server or from the user's computer, since code is executed in their browser?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.