1

I understand that React app is only client side application running in the client browser.

However I have the backend with REST API I need to consume, and the API in under mutual TLS (https), so I need client certificate in order to be able to authenticate and get something from the backend.

But the issue is that the React Front End is running locally in the browser so I do not know how it could be possible to securely store certificate and its private key, if it is even possible.

I was trying to google approach and it seems that the React app cannot consume services which require client certificate for authentication, and there should be at least another backend as proxy, which will be handling both parts, with the React client, and the REST API backend. This proxy can be configured with the certificate and private key and user would not have access to it.

But it requires another component as proxy.

I can also put the React app behind proxy like Apache and setup the mutual client certificate based authentication, however this can help me to identify user inside the React app, not to securely establish mutually authenticated channel with the REST API backend.

It seems that WebAuthN could be the way, however it seems to be designed only for authentication, not the SSL/TLS.

What should be the correct approach? Is it possible to do it with React based app, or this technology is not suitable in that case?

user1563721
  • 1,373
  • 3
  • 28
  • 46
  • Its not possible to securely store certificate and its private key if you are using only react. In our case, we are using server side wrapper (asp.net core) over the react app for this kind of scenario. – Vivek Aug 25 '21 at 18:01
  • @Vivek Is the "server side wrapper" acting as a proxy that adds the cert to each outgoing request to an API? – user2966445 Aug 25 '21 at 18:08

1 Answers1

0

I did research on the same topic, the only solution that I found is to store the certificate on the api and request the certificate using AXIOS.

On the api level you need to test from where the request is coming from and only serve the certificate if the request comes from an authorized IP (your front end).

I couldn't find any other solution.

Allex Radu
  • 1,257
  • 13
  • 24