I have a react js application working on port 3000 and a nodejs working on port 4000. I am using setupProxy as
const createProxyMiddleware = require(`http-proxy-middleware`)
module.exports = function (app) {app.use('/api/*', createProxyMiddleware({ target:http://localhost:4000', changeOrigin: true, }))}
On server, running on port 4000, I am using cors as:
app.use(cors((cors.CorsOptions = { origin: `http://localhost:3000`,})))
The application on localhost:3000 is exposed as https://example.com/
I have an end point on Node server as /api/todos which perfectly accessible from react client.
Outside world can post for example https://example.com/api/todos. How to prevent this?
There was a similar post I answered a few days ago here
How to launch a command on the server from a web page ( nodejs )
With that being said though, and maybe a TLDR you need a way to protect your route. This is where you have two options really.
From what it sounds like, the application / front-end are not bound together so option 2 may not be an options.
With option one you would create a JWT token from the front end. This token would contain an encoded string that can only be decoded on the server. You send this token with your post or get request and have middleware to decode and verify the token is valid, if not, don't let it post to the route.