如何验证服务器到服务器的通信

Question

I'm having a few problems trying to decide what would be the best solution for something I'm trying to build.

In the applications simplest form, I have a front end server which allows users to upload files which become associated with their account, for example a video or image. The upload file form posts the upload request to the front end server, which then uses a reverse proxy to pass the request directly along to a storage server's API (https://www.example.com/users/username/upload).

What I'm currently stuck on, is trying to work out what the best way to verify that the request being received at the storage servers API is actually being sent from the reverse proxy from the front end server, as opposed to somebody just sending a direct post request to the storage server's API endpoint.

Any suggestions would be really appreciated!

Answer 1

There are multiple ways to do it:

1. you can use a API Gateway (e.g. APIGEE, AWS AI Gateway etc). Gateway can do request origin validation.
2. You can let front end app to use OAuth (for storage server) and use that to get authenticated/authorized at storage server
3. You can do IP whitelisting between servers & allow a restricted set of IPs in source
4. You can use MASSL (Mutual Authenthicated SSL) b/w servers to make sure only clients which are verified access your API (may be not for your problem directly but can be used with combination)

These are the simple options if you don't need a complicated or more expensive solution.