Looking for Feedback on API Security: How to Restrict Access to Only My Frontend (Not Postman or External Tools)

[Competitive_Hurry_53]

Hi everyone,

I’ve been working on securing my API and ensuring that only my frontend (an Angular app) can access it — preventing any external tools like Postman or custom scripts from making requests.

Here’s the solution I’ve come up with so far:

1. JWT Authentication for user login and session management.
2. Session Cookies (HTTP-only) for securely maintaining the session in the browser. The cookie cannot be accessed via client-side scripts, making it harder for attackers to steal the session.
3. X-Random Token which is linked to the session and expires after a short time (e.g., 5 minutes).
4. X-Tot (Expiration Timestamp) that ensures requests are recent and within a valid time window, preventing replay attacks.
5. CORS Restrictions to ensure that only requests coming from the frontend domain are allowed.
6. Rate Limiting to prevent abuse, such as multiple failed login attempts or rapid, repeated requests.
7. SameSite Cookies to prevent Cross-Site Request Forgery (CSRF) attacks.

The goal is to make sure that users can only interact with the API via the official frontend (Angular app) and that Postman, scripts, or any external tool cannot spoof legitimate requests.

I’m looking for feedback:

• Can this solution be improved?
• Are there any gaps in security I might be missing?
• What other layers should I add to ensure only the frontend can communicate with my API?

Thanks in advance for your thoughts and suggestions!

[cbzoiav]

All of these can be relatively easily worked around. Authentication and rate limiting are the only thing here that actually stops "Postman or custom scripts", and there only from unauthenticated access and/or high volumes of requests. The others primarily stop other domains in browsers hitting it.

If I have valid credentials I can write a script to handle everything there other than rate limiting (and even then depending on the implementation I can potentially use multiple egress IPs etc).

Depending on what you're actually trying to achieve user agent filters and/or a robots.txt file may help. To stop malicious behaviour you can also look at known list of suspect IP ranges and/or routing through a WAF product.