How to Idenify/filter which client(multiple Mobile & web requests) is calling to an API hosted on Azure(App Service possibly) ?

Question

SidK 21

This is about reusable API. Is this achievable through API Management or some other service like Front Door etc.

Answer 1

MughundhanRaveendran-MSFT 12,121 Microsoft Employee

Thanks for reaching out to Q&A.

If you integrate APIM in front of app service, APIM maintains Client IP through context variable as follows: context.Request.IpAddress

The Client IP needs to be passed along to the App service by way of defining a header via a small policy snippet:

<set-header name="X-Forwarded-Client-Ip" exists-action="override">
<value>@(context.Request.IpAddress)</value>
</set-header>

The corresponding value then can be accessed in the app service code HttpRequest object as follows:

public static async Task<IActionResult> Run(HttpRequest req, ILogger log)
{
....

var clientIP = req.Headers["X-Forwarded-Client-Ip"];  
....

}

I hope using the client ip you will be able to figure out the client app. Feel free to reach out to me if you have any queries or concerns.

Please 'Accept as answer' and ‘Upvote’ if it helped so that it can help others in the community looking for help on similar topics.

SidK 21 Reputation points

2022-08-23T08:12:06.853+00:00

Thank you for the comment . But I need to know which external clients connect to my API. It's about how to know (say app1 , app2, web app1,web app2) , which one of the application is making requests.
and allow requests coming from legit application only(say for here we just want to allow requests coming via app1 , app2, web app1,web app2 )
MughundhanRaveendran-MSFT 12,121 Reputation points Microsoft Employee

2022-08-29T10:32:41.627+00:00

@SidK , Unfortunately, APIM doesnt have the client context apart from the client ip. You can send any additional headers from the client which can be identified at the server side.
markusr 6 Reputation points

2022-08-31T06:13:28.107+00:00

Hi
In APIM you can create product and you can create different subscription for each client application. Then clients send subscription-key as parameter or header. Then in API Management Monitoring > Analysis -section you can filter using subscription.
It's also possible to create different products for each client application and client can use subscription-key from product. You can use use product to filtering in Analysis-section.

1 answer