I'm developing the restful web app that using some popular web framework on the backend, say (rails, sinatra, flask, express.js). Ideally, I want to develop client side with Backbone.js. How do I let only my javascript client side interact with those API calls? I don't want those API calls to be public and be called by curl
or simply by entering the link on browser.
As a first principle, if your API is consumed by your JS client, you have to assume, that it is public: A simple JS debugger puts an attacker into a position, where he can send a byte-for-byte identical request from a tool of his choice.
That said, if I read your question correctly, this is not, what you want to avoid: What you really don't want to happen is, that your API is consumed (on a regular basis) without your JS client being involved. Here are some ideas on how to if not enforce, then at least encourage using your client:
I am sure, your API has some sort of authentication field (e.g. Hash computed on the client). If not, take a look at This SO question. Make sure you use a salt (or even API key) that is given to your JS client on a session basis (a.o.t. hardcoded). This way, an unauthorized consumer of your API is forced into much more work.
On loading the JS client, remember some HTTP headers (user agent comes to mind) and the IP address and ask for reauthentication if they change, employing blacklists for the usual suspects. This forces an attacker to do his homework more thoroughly again.
On the server side, remember the last few API calls, and before allowing another one, check if business logic allows for the new one right now: This denies an attacker the ability to concentrate many of his sessions into one session with your server: In combination with the other measures, this will make an abuser easy detectable.
I might not have said that with the necessary clarity: I consider it impossible to make it completely impossible for an abuser to consume your service, but you can make it so hard, it might not be worth the hassle.
this is helpful info , but what if i want to make some auth from my backend api to another api app like a separate server , to simplify my question , i want my back-end aka node.js to send fetch request to another back-end server which is my own , for some reasons this is needed , but i want to secure the api calls , as it can access sensitive data , and i can't use sesions or jwt because i can't store them actually in browser.
@Thepyramid It doesn't matter, what the API call does on the server side, especially if the server side does another 2nd-ĺevel API call. The important part is to treat your server not as a proxy, but as an application.
can you explain more how to make as application not as proxy
What I mean is: To get a decent amount of security you need to employ all tools, that a webapp has: Sessions, an auth database, a business logic. If don't do that and just treat your server as a way to pass requests to another server, you are just using it as a proxy for that other server and are limited by whatever security that other server offers.
@PirateApp An attacker can easily just ignore the CSRF headers. They work only, if the end device is an unpatched browser