I want to secure my Sitecore JSS LayoutService in such a way that only the client application (i.e. react app) can access my LayoutService API.
Please note, I am not taking about the login/logout mechanism of Sitecore, its a simple JSS-react app.
I understand Sitecore provides a SSC_APIKey logic for JSS layout service and CORS origin security mechanism out of the box plus we have options to add throttling strategies but after all this its quite easy to get the LayoutService URL and its API key in the network tab of the deployed react APP. Hence the LayoutService is publicly accessible. One can easily consume my LayoutService with these details via some tools like postman etc.
Any solution/thought is much appreciated.