I'm very new to websites.
I'm trying to process payments using Stripe in a JS file, and this file is static meaning it is public. I'm trying to take the part that makes an API request with a secret key and move it to the backend and then call the backend to receive the response that comes from using the secret key.
However, currently any person is able to make the request, which defeats the purpose of what I am doing.
def payment(request):
return render(request, 'interface/about.html')
def get(self, request, *args, **kwargs):
return(HttpResponse("laterthere"))
urls.py
path('payment', views.payment, name="payment")
JS:
var resp1 = await fetch('https://url.com/payment', {
method: 'GET'
});
Is there any way to do this? If suggesting a better direction to go in please do provide resources.
You need to add authentication to your API. This way you can assign permissions to users so that only they can access certain login. As an example, imagine you build your User model, to have a is_admin property (which is default by django). Then you can check if the user is an admin.
def get(self, request, *args, **kwargs):
if request.user.is_admin:
return(HttpResponse("laterthere"))
else:
raise AuthenticationError
Here is more information for DRF https://www.django-rest-framework.org/api-guide/authentication/