通过限制请求源来保护REST API

Question

I am about to create a REST API that would serve its resources to a mobile apps, these includes iOS & Android smartphones.

Now I am concern of limiting my API to serve only request coming from apps, that means if the request is done via browser then I should deny it. The reason for this is I am concern regarding the XSS attack and such.

Am I wrong in what I am thinking now? If no, then how should I tell that the requestor is coming from an App?

Answer 1

You are spot on and securing REST endpoints is very essential to ensure that you authenticate/authorize/control requests to your server resources.

Here is a thread that discusses some best practices: Best Practices for securing a REST API / web service