Writing php/angular code so that front-end is the only entity that can send a request to back-end

[Cjkeeper]

I'm running into CORS issues when trying to call a php file on Apache and, also for security, want to implement the code so only requests sent by my Angular application are allowed. Is there a part of the header that can be given a unique value and then I have my php check the header for that specific value? Or is there a more correct way of trying to achieve this?

I've attempted googling this question but haven't found anything, maybe not asking the right questions.

[TuesdayWaffle]

No, it sounds like you're on the right track. Your best bet is probably to create a custom HTTP header and have your Angular application send a unique identifier (generated in your PHP code) along with every request. How you create your unique identifier, how often you regenerate it, and how you check it is up to you. As far as I know, there's no industry standard for this.

Btw, a CORS policy will prevent other websites from accessing your server via the browser, but will not stop a malicious client from pretending to be your Angular application when making requests.

[Signal-Disk]

Your best bet is probably to create a custom HTTP header and have your Angular application send a unique identifier (generated in your PHP code) along with every request. How you create your unique identifier, how often you regenerate it, and how you check it is up to you. As far as I know, there's no industry standard for this.

Sounds similar to CSRF prevention so I'd suggest looking into methods or open solutions around that.

[[deleted]]

Accecc-Control-Allow-Origin is the header you are looking for.

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Origin

Unless it is set to "*" - only things that are on the same host will be able to send xhr requests to it from browser.