how to secure Frontend app service calling a backend app service

Question

We have 3 app service ui, be, wf all the app services are in private network. Ui app service is linked with a custom domain for direct use, there are some features which need the intervention of backend, so while calling backend service, it wont happens as it was in private network. So have get a custom domain for the backend app service to get it accessed by the frontend app service.

So is there any way we can secure the backend service coz there are a lot of crucial data's are there.

Answer 1

Hi @Pratik Pragnya Tripathy - thankyou for posting the question

What you actually do should be based on your overall requirements - as some features add complexity and additional cost which could otherwise be avoided if not required

We would need more details about what you're doing and what those requirements are, but for a very short high level answer

• If the only public access is via the UI/Front end app and that app is "virtual network integrated" then the other apps can be access over a private endpoint and the access through the public endpoint for those other apps can be turned off.
• You have the option of using either Azure Front Door or Application Gateway which both have a Web-Application-Firewall (WAF) feature, if you need that extra layer of functionality in front of your apps. If you did then it would be possible to broker public access to the front end / UI through either Front Door or Application Gateway and have the rest of the network path private
• Whatever you do or don't do with the network path, it's important you have good authentication and authorization. It is common that some public facing web sites have some anonymous content , but generally content is only accessible once a user is logged in. In addition, it's good practice to have authorization between front end and backend and any other dependent services/databases.
• Logging and App performance monitoring are also important
• Any database, storage or cache used should have controls from a network perspective (where applicable) as well as authorization
• It is also possible to incorporate a L3/4 firewall for customers who have that requirement (for example where dependencies are required on-premises or from another network

please let us know more about you're requirements and we can give you advice on how to achieve those requirements in Azure using App Service (and other services)