Restricting consumers to access api proxy urls

[#1]

I am finding out solution on how clients can be restricted to access Proxy url.

In browser based clients,if we have one-way SSL/TLS,we can setup CORS Allow-origin to static client's domain name,instead of " * " or "request.header.origin", so that we can restrict a particular client's access to Proxy url.

Or,if we have 2-way SSL/TLS,we can ensure only authenticated clients access the proxy url.

In Application based clients,only way is to enable Two-way SSL.Is JWT token also helps in this case?

I am not sure whether this understanding is correct.Please suggest if any other solutions.

I am trying to restrict access before even some unknown client tries to access Proxy url by submitting their credentials,in case of one-way SSL.

[gnanasekaran]

Hello @RK4,

You can restrict consumers as long as you can identify the consumers.So basically you need to establish an mechanism for identifying the consumer of your APIs, which can be done either at the transport level or at the application level

At the transport level, you could use

> IPs

> Certs - 2-way SSL

or

At an application level, you could do things like,

> Basic Authentication

> Key based authentication

> Oauth, 1.0a or 2.0

> JWT

> SAML

etc.. basically any application authentication scheme.

So as long as you enforce any of these authentication scheme for your APIs - you could easily restrict consumers to access your API [In Apigee, this is basically the proxy URLs]

Thanks,