Secure backend Appservice

Rahul 1

I have an application that consists of a "front-end" website, and a back-end web API. Iwant the end users of my application to be able to access the front-end website, but ionly want the front end to be accessible to the end users. The back-end should be locked down so it is only callable from the front-end.

Please suggest some better solution, I have tried multiple things but did not get any proper solution.

Lex Li (Microsoft) 5,662 Reputation points Microsoft Employee

2019-12-09T19:14:05.637+00:00

Then you asked an invalid question. The so called "front-end" is just HTML+JavaScript, so everything is visible to your end users, and they can feel free to call your back-end in the same way. There is no way to prevent your end users from doing so (things like headless Chrome are even more convenient for them). Don't waste your time on such, but harden your back-end with proper authentication/authorization.

1 answer

Bartosz Pelikan 41 Reputation points

2019-12-09T18:18:00.697+00:00
Have you tried to use service endpoint for App Service?

Here is some references that could be helpful:

https://learn.microsoft.com/en-us/azure/app-service/app-service-ip-restrictions

https://markheath.net/post/securing-backend-appservice-webapps

https://robertsmit.wordpress.com/2019/05/29/configure-azure-service-endpoints-for-web-applications-azure-ase-endpoints-azureserviceendpoints-webapp-azuredevops/
Please sign in to rate this answer.

2 people found this answer helpful.
Rahul 1 Reputation point

2019-12-10T04:18:53.837+00:00

I tried service endpoints, after that my web app is not able to connect with API app, getting 403 IP forbidden error.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Secure backend Appservice

1 answer

Your answer