39 ms·
Using the front end as the glue sounds dangerous. If you are accessing a third party api via the front end directly I can't see a way around passing whatever au
by jklein11 7y ago
Using the front end as the glue sounds dangerous. If you are accessing a third party api via the front end directly I can't see a way around passing whatever authentication mechanism they use to the client. This is giving pretty open access to hit the api with your credentials.
- dmlittle 7y agoIn this case it’s not a third party API but your own products API. Also while you can use the same endpoints, authentication and authorization don’t have to be the same. You could use your standard basic auth (or other) for your regular API use case and then use cookie based auth or JWTs (or whatever other auth you want) for the SPA. Again this isn’t for third party APIs but for companies creating a web app for their own apps so you can have flexibility.