We have created a Rest API using Spring. There is no security implemented.
Now we are going to use Apigee for API management, it will provide various services, for monitoring, security, etc. All our clients should now call our API using the new Apigee addresses rather than directly calling our service on our server.
How can we enforce that the bypassing of Apigee is impossible?
I guess, in our code, we can have a filter and use the "Access-Control-Allow-Origin" property, something like:
public class OurFilter implements Filter
{
public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain) throws IOException,
ServletException {
HttpServletResponse response = (HttpServletResponse) res;
response.setHeader("Access-Control-Allow-Origin", "*");
response.setHeader("Access-Control-Allow-Methods", "POST, GET, PUT, DELETE");
chain.doFilter(req, res);
}
}
Where the "*" would be replaced by the Apigee Ip, domain name or something.
My question is how safe is that. Can people just add a header to their HTTP request and call our server directly successfully anyway? Or does it check the origin IP on the low level individual "IP packets".
And if it is spoofable just by editing the HTTP header, what is the right way to make the bypassing of Apigee impossible?
Many Thanks
LinkedIn
Twitter
