search

kgrzybek / modular-monolith-with-ddd

Full Modular Monolith application with Domain-Driven Design approach.
MIT License
10.89k stars 1.71k forks source link

How to secure API resources (e.g. user registration endpoint) #263

Open ahmedtanveer opened 1 year ago

ahmedtanveer commented 1 year ago

Hi,

Thanks for the great piece of work.

How do you secure your APIs so that only your React client can access. For e.g. if user registration endpoint isn't secured, anyone can post request and create unlimited users. In this case, how you would secure the APIs, specifically, those endpoints which don't have Authorize attributes.

Really appreciate help in this regards. Thanks in advance.

ahmedtanveer commented 1 year ago

Hi @kgrzybek , @kmasalski , I would really appreciate your response on my question.

danias commented 1 year ago

@ahmedtanveer an idea would be to create some sort of middleware that logs IPs and limits the number of requests they can make. This is useful even for secured endpoints because you could have a user registering and then performing a DoS attack to your system. The registration endpoints could have stricter quotas than the normal usage ones.