使用GoLang后端反应JS Rest API安全性

Question

I have built a ReactJS Frontend with GoLang Backend. All the data is being requested/sent by ReactJS from/to Golang Backend using Rest APIs.

I am quite confused on what will the best way to secure my API requests so that one does not pro-grammatically hit my backend server and make undesired changes. Any advice will be really appreciated.

I have been exploring JWT tokens and CSRF tokens but am not going anywhere with how to exactly implement it in my application due to my lack of expertise in the API security domain.

Some further details about my application are:

1. The frontend and backend server are separate.
2. The frontend server is using Nginx to serve the static files.
3. A new token should be generated everytime the page is opened and it should be valid for no more than 8 minutes.

Please suggest to me what would be the best way to secure my rest APIs given the structure of my application.

P.S.: There is no login or any other mechanism for this page which would establish the authenticity of the user.

Answer 1

I would suggest using JWT for API security as your token expiry time is short enough.

• https://github.com/dgrijalva/jwt-go --> Use this package to generate token in backend and set expiry time and claims as per your need. Your claims can have granular control(Auth layer) too based on roles.
• Send this token to your front end from login or any endpoint which is the gateway to your API.
• Store the token in local storage/https cookie as per your wish at your front end.
• With every API call which needed to be secured send this token in header, validate this token at back-end using the library mentioned above.
• Challenge will be to invalidate these tokens on forgot or reset password/logout. You can use blacklist token technique by keeping them in redis/db and flushing them regularly with cron.