2

I'm setting up an AWS API Gateway + Lambda micro-service that will return non-sensitive but user-specific data.This means that the responses from the service can't be cached and served to multiple users.

There is a possibility that unauthorized third parties will hit this service and cause large spikes in resource usage.

Why does it have to be a client side request?

Pages on the main website are usually cached and served from CloudFront without sending each request to the origin server so it is impossible to make this request server-side for each user.

Ideas I've Had

  1. Requiring an API key to be used to access the service.

    This is unlikely to be the magic bullet because even if the key itself is hidden by making a call to a separate back-end script, all an unauthorized user would have to do is call the script instead of the API directly and they would get the same results.

  2. Adding custom checks based on headers, origin etc. before sending a valid response from the API

    These things can be spoofed relatively easily so it's by no means guaranteed to work but it might deter a lot of less motivated people.

Is there anything else that can be done to ensure that this service is only accessed by people actually viewing the website and not third party applications?

Improve this question
5
  • 4
    Sounds like you need first-class security like an actual authentication mechanism.
    – Robert Harvey
    Commented Jun 18, 2018 at 15:15
  • Do you have any suggestions for one that would match my constraints? The API has to work for users who aren't logged in and I can't generate an on-page token for every page request due to the full page caching I mentioned.
    – Commit
    Commented Jun 18, 2018 at 16:09
  • 3
    "The API has to work for users who aren't logged in" means you cannot "ensure that this service is only accessed by people actually viewing the website and not third party applications." How would you do it if you're not allowed to authenticate your users?
    – Robert Harvey
    Commented Jun 18, 2018 at 16:14
  • 1
    So what about getting the token from your authentication service and using that token for your future calls. A common token format is JWT, and this is essentially how OAuth works. The JWT is encoded with a number of attributes that are important to your application, and is often encrypted or hashed.
    – Berin Loritsch
    Commented Jun 18, 2018 at 18:43
  • I ended up going with rate limiting as a solution to the issue as the comments made by @RobertHarvey were correct but user authentication was not possible in this particular scenario.
    – Commit
    Commented Jun 24, 2018 at 14:45

2 Answers 2

Reset to default
1

In this case, i would add various kinds and combinations of rate-limiting, e.g.:

  • maximum requests per interval allowed for the complete API
  • maximum requests per interval for specific parts of the API, if you have certain calls that are 'expensive'

If you are able to identify non-authenticated calls, e.g. by IP-Adress or Cookies or something, you may be able to additionally limit that even more accurate. E.g.:

  • maximum requests per client per interval for complete API
  • maximum requests per client per interval for specifica parts of the API

Interval could be anything, e.g. hardcoded 5 seconds, in a fixed or a sliding time window.

In one project I implemented something like that using a combination of ip-adress and if available the user-id, and it worked very well - protecting the service from misuse/attacks of anonymous, identifiable and even properly authorized clients.

Iirc I used https://github.com/mokies/ratelimitj - the readme there also points to some background articles, e.g. https://blog.figma.com/an-alternative-approach-to-rate-limiting-f8a06cf7c94c

Improve this answer
-1

In context of rate limiting i think AWS API Gateway has build in mechanism for that, configuring which is relatively simple. (AWS API Gateway Quotas)

What Are Usage Plans and API Keys? A usage plan specifies who can access one or more deployed API stages and methods — and also how much and how fast they can access them. The plan uses API keys to identify API clients and meters access to the associated API stages for each key. It also lets you configure throttling limits and quota limits that are enforced on individual client API keys.

https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-api-usage-plans.html

In context of User and robots check simple login service, that can be integrated with API Gateway:

https://aws.amazon.com/cognito/

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.