JSS layout service, how to restrict public access

Question

I want to secure my Sitecore JSS LayoutService in such a way that only the client application (i.e. react app) can access my LayoutService API.

Please note, I am not taking about the login/logout mechanism of Sitecore, its a simple JSS-react app.

I understand Sitecore provides a SSC_APIKey logic for JSS layout service and CORS origin security mechanism out of the box plus we have options to add throttling strategies but after all this its quite easy to get the LayoutService URL and its API key in the network tab of the deployed react APP. Hence the LayoutService is publicly accessible. One can easily consume my LayoutService with these details via some tools like postman etc.

Any solution/thought is much appreciated.

Answer 1

Well you can't.

The one mechanism that could lock that service down with something that could not just be picked up on the network tab and restrict access to the service to only those people you decide does exist. It's called Authentication, and you're ruling that out.

If you think this through; if not authentication, what would you lock down the service on? IP Addresses? no good if it's a public website.

The second thing to consider; the LayoutService doesn't expose anything that you've not granted public access to in the first place. It very much respects Sitecore security (unless you deliberately break that, and have it running in the context of an admin user). So presumably there's nothing anyone could get via LayoutService, that they would not be able to get via your React App in the first place.

Answer 2

Few Options to disbale access are

1. network level access to the Sitecore instance from hosted node server
2. adding a pipeline to check incoming request has a custom header key value which is passed by the node or other application when they make request.