Limit API only to main application

[plush monolith]

Hello everyone, how can I make some routes only available to the main app, while some others to all website. Please use middleware if possible, if not, no problem.

[indigo fiber]

Post created!

🔎 This post has been indexed in our web forum and will be seen by search engines so other users can find it outside Discord

🕵️ Your user profile is private by default and won't be visible to users outside Discord, if you want to be visible in the web forum you can add the "Public Profile" role in id:customize

✅ You can mark a message as the answer for your post with Right click -> Apps -> Mark Solution
(if you don't see the option, try refreshing Discord with Ctrl + R)

[shy sundial]

that is impossible, you can always include some kind of secret in reqs from your site and check that secret and handle accordingly.

[plush monolith]

What about CORS

Or does that not fix the problem

[grand magnet]

check this message and the discussion above it which discusses this exact question #discussions message

[plush monolith]

Ok thanks

[grand magnet]

tldr it is impossible; with CORS you only prevent fetches from the browser, but fetches from curl or nodejs are still possible <- but this can be mitigated by rate limit

[plush monolith]

I can still fetch from the browser

Even with CORS

[grand magnet]

that means you configured CORS incorrectly

if CORS is configured correctly, something like this should appear in the browser (unless you explicitly disabled CORS checking in your browser e.g. by using a browser extension)