0

I have an API developed in PHP for my Flutter web app. I am using this API to fetch all the data. But, I can see all the requests made to the server.

Is there any way to hide/restrict any unauthorized person to use my API? I am using HTTP library to make calls from my flutter app to API. I just want to hide those calls to web API. I have seen some websites do that. Since the server code and website code in those websites are in the same directory it can be accessed directly without having to make a request to the webserver.

Xihuny
  • 1,410
  • 4
  • 19
  • 48
  • Usually backend/API should have some authorization mechanism? Does your API have oauth support? –  May 29 '20 at 23:55
  • No, it doesn't have OAuth. But even if I use OAuth anyone with the token can make a request to my server right? I want API to accept request made from my website. – Xihuny May 30 '20 at 00:12
  • @mabujaber also, I am sending a secret key with every request but since all the requests are easily visible from even Chrome inspect tool, I can see the encrypted key from there. – Xihuny May 30 '20 at 00:13

1 Answers1

2

Two problems I see are

  1. You are able to see all the request made to backend server from your web page and you want to hide them.

The answer to this is No you cant. I say this based on my search in google and some posts in SO like this

You may think about disabling the developers tools. The answer is No and maybe with unknown side effects.

  1. Is there any way to hide/restrict any unauthorized person to use my API?

The answer to this question is yes and can be done in many approaches. Like you said token based authorization has its own issue with keys being leaked and thats why there is always validity associated with it and should be considered. There are mechanisms such as refresh tokens to renew tokens etc.

The first and foremost thing I would do is enable CORS mechanism in your sever where the server will only allow request from very specific domains to be processed. More details available here

Abhilash Chandran
  • 6,803
  • 3
  • 32
  • 50