First of all , apologies for being an Nginx newb. We utilize third-party API's that require authentication and we want to secure the API key by setting up a reverse proxy in Nginx. I'm pretty sure I get how to set up this part - create a
proxy_pass it to the third-party server and add in authentication headers.
However, even though the API key is secure, at this point any user has full access to the API through the front-end URL, is that right? How I would I limit access to the proxied API to requests coming from the web server itself? Is adding a CORS header the correct solution here?
Part of my confusion is I'm not sure what is the 'origin' of a AJAX request in front-end code? Does it count as coming from the web server or from the user's computer, since code is executed in their browser?