I am building a web application that will retrieve results from a remote server and use them to render some charts and maps. The remote server has already been implemented and contains a large amount of APIs, written in
Java Spring Framework. The developer that implemented them, has given me access to a set of non-public endpoint URLs, which I will query and get the results in JSON format. Please note that some time in the near future, some of these APIs will be sensitive and should be limited to authenticated users only.
From my side, I am developing only the frontend with
ReactJS. The entire logic of the calculations, the user maintenance, the authorization/authentication as also as the user input, happens on the remote server via these API calls.
Now, my question is this: where is a good place to put the web service calls? As far as I am concerned, there are two options:
- Create asynchronous
AJAXcalls in the existing
ReactJScode, that will retrieve the required data and render the charts
- Create a second backend, written in
Djangoframework, which will do all these API calls, effectively isolating them (they are subject to change) from the
ReactJSapplication and providing a way to securely "hide" the information regarding the actual URLs from a potential intruder. The backend will "talk" with my frontend via a set of calls, different than those of the external server.
The quickest and easiest way is to go with the first approach. But is it a good practice to have sensitive API calls, that due to the nature of the application are subject to change anytime, in the
JS code which is only for rendering the client-side?
By having a second set of calls in my local backend, I am allowed to decouple the remote APIs from my application, maintain them more easily, change and secure them and remove the ability from an end-user to inspect the webpage's code and see the actual URLs in plain format.
I know of course that the end-user will be able to see some API calls, but I am more comfortable with him seeing mine APIs (going into my backend), than giving him the ability to see (and maybe use) the remote APIs.
Here's is a simple sketch of the two alternatives:
Is there any obvious gains by following the second approach or am I over analyzing this?