I have been searching on Google and SO for hours now but without finding the someone with the same challenge as I now face so here goes:
We have a database with which we put a lot of money and effort into maintaining. The data from the database is publicly available through an REST-API. We also have a public javascript web app that consumes this API and which we sell to some 30-40 customers. As the data in the API is quite valuable to us we want to try to secure it so that no one can scrape the content from it and make their own copy of our database. Nor do we want anyone building services using our API without our consent. At the same time, we need our web app at http://www.example.com/theApp, http://www.example2.com/theApp, http://www.example3.com/theApp etc to be able to access the API. There are no users involved. Everyone can go to http://www.example.com/theApp and get the full feature of the site. The API is also read only so we are not concerned by anyone trying to pollute our data.
The javascript web app is built with react.js with a node.js server. SSL will, of course, be used for all communication between servers and client.
Things that I think will NOT work:
- Making the users log in to use http://www.example.com/theApp. (There are no extra features for logging in so this will just annoy the users.)
- Storing a password/token in the web app. ( Nothing in javascript is safe however mush obfuscating one does.)
- Making the web app client request a token from an authentication server. (This request can also be done by hostile clients.)
- Whitelisting allowed IPs. (Everyone can access the sites...)
- Whitelisting URLs. (URL is sent as a header. Headers can be manipulated.)
Things that might work (or at least be part of the solution):
- Having the node.js server-app request a token from the authentication server on behalf of the client. (But I still do not know how this will prevent a hostile client making the same request to the node.js server-app)
- Obfuscating. (This could put off most hostile users, but the more persistent (and most skilled/dangerous?) would just be excited by the challenge and will eventually be able to crack it.)
As this is quite a complicated thing we are trying to achieve, heck I am starting to believe it might be impossible, I would greatly appreciate if anyone has some advice about what to do. "Don't do it" is a perfectly good answer if good reasons are given. I am more of the conceptual solution here, but if anyone wants to be concrete on software we have a Linux environment with node.js, Nginx and PHP.