search

bcgov / nr-forest-client

FSA Forest Client
Apache License 2.0
2 stars 1 forks source link

Remove backend route and use Caddy to route requests #842

Open paulushcgcj opened 6 months ago

paulushcgcj commented 6 months ago 
          > > @mishraomp @paulushcgcj Backend route removed!

Please don't do that, reverting the route for now

may be a ticket in the backlog to align this with QSOS , thoughts?

Originally posted by @mishraomp in https://github.com/bcgov/nr-forest-client/issues/829#issuecomment-1981676071

DerekRoberts commented 6 months ago

@paulushcgcj You're right, this is better. :+1:

paulushcgcj commented 3 months ago

Is this still relevant @DerekRoberts and @mishraomp?

What would be the benefit of doing this? I mean, the backend API will still be exposed if this is the concern. Another thing that can be problematic is the rate-limiting, so I was wondering about the relevance of this.

We can discuss that to evaluate if and when this issue can become some task to be worked on.

mishraomp commented 3 months ago

Is this still relevant @DerekRoberts and @mishraomp?

What would be the benefit of doing this? I mean, the backend API will still be exposed if this is the concern. Another thing that can be problematic is the rate-limiting, so I was wondering about the relevance of this.

We can discuss that to evaluate if and when this issue can become some task to be worked on.

The main advantage of removing the route to removing the exposure of the entire API. for ex: if Caddy is proxying /api/*** endpoints, then only that gets exposed, other endpoints which are not /api/*** are still internal, which could be a good thing from security standpoint, if backend has multiple integrations.

DerekRoberts commented 3 months ago

@paulushcgcj It also prevents hard coding, which has been an issue on some projects. Like poiting their DEV PR instances at TEST or, worse still, PROD backends.

mishraomp commented 3 months ago

@paulushcgcj another point, if we remove the exposure to internet, then no need of CORS, which avoids the OPTIONS API call, means lower latency :)

cc @DerekRoberts