0

My Rails backend (api.mydomain.com) is hosted in EBS. The EC2 hosts have a VPC security group. The VPC security group's inbound rules only allow the corresponding load balancer security group on HTTP. The load balancer security group allows 0.0.0.0/0 on both HTTP and HTTPS. I would like to restrict API calls that hit my Rails backend to only come from my Angular app hosted in S3 (mydomain.com). Is this possible?

I want to prevent other servers from hitting my APIs.

gruuuvy
  • 2,028
  • 4
  • 31
  • 52

1 Answers1

0

It's not related to your AWS security things; you should set CORS settings for your backend API and set your API only accept the request from your domain.

enter image description here

Understanding CORS

The same-origin policy is an important security concept implemented by web browsers to prevent Javascript code from making requests against a different origin (e.g., different domain) than the one from which it was served. Although the same-origin policy is effective in preventing resources from different origins, it also prevents legitimate interactions between a server and clients of a known and trusted origin.

Cross-Origin Resource Sharing (CORS) is a technique for relaxing the same-origin policy, allowing Javascript on a web page to consume a REST API served from a different origin.

For more information read the following documents:

https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS

https://www.html5rocks.com/en/tutorials/cors/

https://en.wikipedia.org/wiki/Cross-origin_resource_sharing

and these docs about CORS and Rails

https://demisx.github.io/rails-api/2014/02/18/configure-accept-headers-cors.html

https://til.hashrocket.com/posts/4d7f12b213-rails-5-api-and-cors

How to enable CORS in Rails 4 App

Reza Mousavi
  • 4,420
  • 5
  • 31
  • 48
  • CORs prevents JavaScript from other domains from hitting my APIs, but I would like to prevent other servers from hitting my backend. – gruuuvy Oct 17 '18 at 16:31
  • So, edit your question and add it, because your question mentioned the angular app. – Reza Mousavi Oct 17 '18 at 16:49
  • As far as I know, it's not possible; the S3 is a container for your files, all request to your API came from your users IP addresses. – Reza Mousavi Oct 17 '18 at 16:53