How to make sure that only a specific domain can query from your REST api?

Question

I have an app that has a REST api. I want it so that the only requests that can be made to the REST api are ones originating from the app itself. How can I do that? I am using a node.js+express server too.

EDIT: the app is fully a public web app.

Answer 1

Simply define the header in your request, what this does is, it allows requests only from a certain domain, and instantly rejects any other domain.

response.set('Access-Control-Allow-Origin', 'domain.tld'); 

EDIT: IF you're really keen against web scraping stuff, you could make a function to double check client's origin.

function checkOrigin (origin) {    if (origin === "your.domain.tld") {      return true;    } else {      return false;    } } /* Handling it in response */ if (checkOrigin(response.headers.origin)) {   // Let client get the thing from API } else {   response.write("Send them error that they're not allowed to use the API");   response.end(); } 

Above example should work for the default HTTP/HTTPS module, and should also work for Express, if I'm not mistaken.

EDIT 2: To back my claim up that it should also work for Express, I found this quotation at their documentation;

The req (request) and res (response) are the exact same objects that Node provides, so you can invoke req.pipe(), req.on('data', callback), and anything else you would do without Express involved.