There are two APIs (A and B) hosted on the same network. A is open to the internet but B is not. Requests to A are currently secured by JWT which users get after logging in. B needs to fetch data from a GraphQL endpoint in A. Due to limitations in A's implementation, it is not feasible to make B act like a "user". What are my options to ensure that A cannot be accessed by unwanted clients?

Right now I'm thinking of simply sending a password with each request which A will check if correct. But I feel like this is not secure.

Another option might be OAuth but that seems excessive for this.

What are my options?

Edit: One more thing to add, both APIs are already using HTTPS.

  • 3
    Precisely what threat are you trying to protect against here? Jun 19 at 16:18
  • @PhilipKendall The data is sensitive so it should only be read by authorized users and the API B. A is behind Cloudflare so I'm assuming it's relatively safe from bots/DDoS.
    – mismaah
    Jun 19 at 16:21
  • 1
    Due to limitations in A's implementation, it is not feasible to make B act like a "user" Can you please explain what you mean by this?
    – John Wu
    Jun 19 at 17:11
  • 6
    @mismaah: That's not a technical limitation. That's not having asked IT support to create a service account for this express purpose. This sounds like an administrative problem, and it should NOT be alternatively solved by compromising A's security just so you don't have to make a service account. Service accounts are nothing new and should be created for this very purpose. To A, B is just another requester just like all other end users and it should be treated as such.
    – Flater
    Jun 19 at 22:46
  • 3
    You can provide service B with a client certificate, and configure service A with client certificate mapping authentication.
    – John Wu
    Jun 20 at 8:27


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.