How to protect the Backend API against calls other than Azure API Management
I have an ASP.NET Core REST API Service hosted on an Azure Web App. I own its source code and I can change it if required.
I am planning to publish REST API Service with Azure API Management.
I am adding Azure AD authentication to the Azure API Management front. So, the API management front is secured. All the steps are is described here.
All good so far. Here is the question (or challange?) :
Considering that my backend REST API Service is hosted on Azure and publicly accessible, how do I protect it against the request calls other than the API Management Calls?
How the backend service knows the identity and AAD group claims of the incoming call and access to its claims?
A link to a code sample or online documentation would be a great help.
Update
While there are some overlaps with the follwoing question:
How to prevent direct access to API hosted in Azure app service
... part of this question is still outstanding:
How the backend service knows the identity and AAD group claims of the incoming call and access to its claims?
azure-api-management
asked Nov 13 '18 at 0:00
Allan XuAllan Xu
1,78111837
add a comment |
I have an ASP.NET Core REST API Service hosted on an Azure Web App. I own its source code and I can change it if required.
I am planning to publish REST API Service with Azure API Management.
I am adding Azure AD authentication to the Azure API Management front. So, the API management front is secured. All the steps are is described here.
All good so far. Here is the question (or challange?) :
Considering that my backend REST API Service is hosted on Azure and publicly accessible, how do I protect it against the request calls other than the API Management Calls?
How the backend service knows the identity and AAD group claims of the incoming call and access to its claims?
A link to a code sample or online documentation would be a great help.
Update
While there are some overlaps with the follwoing question:
How to prevent direct access to API hosted in Azure app service
... part of this question is still outstanding:
How the backend service knows the identity and AAD group claims of the incoming call and access to its claims?
azure-api-management
asked Nov 13 '18 at 0:00
Allan XuAllan Xu
1,78111837
Possible duplicate of How to prevent direct access to API hosted in Azure app service
– MKaz
Nov 13 '18 at 7:45
@MKaz, please see my update.
– Allan Xu
Nov 13 '18 at 17:06
See stackoverflow.com/questions/52173908/…
– Vitaliy Kurokhtin
Dec 3 '18 at 18:46
add a comment |
I have an ASP.NET Core REST API Service hosted on an Azure Web App. I own its source code and I can change it if required.
I am planning to publish REST API Service with Azure API Management.
I am adding Azure AD authentication to the Azure API Management front. So, the API management front is secured. All the steps are is described here.
All good so far. Here is the question (or challange?) :
Considering that my backend REST API Service is hosted on Azure and publicly accessible, how do I protect it against the request calls other than the API Management Calls?
How the backend service knows the identity and AAD group claims of the incoming call and access to its claims?
A link to a code sample or online documentation would be a great help.
Update
While there are some overlaps with the follwoing question:
How to prevent direct access to API hosted in Azure app service
... part of this question is still outstanding:
How the backend service knows the identity and AAD group claims of the incoming call and access to its claims?
azure-api-management
asked Nov 13 '18 at 0:00
Allan XuAllan Xu
1,78111837
I have an ASP.NET Core REST API Service hosted on an Azure Web App. I own its source code and I can change it if required.
I am planning to publish REST API Service with Azure API Management.
I am adding Azure AD authentication to the Azure API Management front. So, the API management front is secured. All the steps are is described here.
All good so far. Here is the question (or challange?) :
Considering that my backend REST API Service is hosted on Azure and publicly accessible, how do I protect it against the request calls other than the API Management Calls?
How the backend service knows the identity and AAD group claims of the incoming call and access to its claims?
A link to a code sample or online documentation would be a great help.
Update
While there are some overlaps with the follwoing question:
How to prevent direct access to API hosted in Azure app service
... part of this question is still outstanding:
How the backend service knows the identity and AAD group claims of the incoming call and access to its claims?
azure-api-management
azure-api-management
asked Nov 13 '18 at 0:00
Allan XuAllan Xu
1,78111837
asked Nov 13 '18 at 0:00
Allan XuAllan Xu
1,78111837
edited Nov 13 '18 at 17:05
Allan Xu
asked Nov 13 '18 at 0:00
Allan XuAllan Xu
1,78111837
asked Nov 13 '18 at 0:00
Allan XuAllan Xu
1,78111837
asked Nov 13 '18 at 0:00
Allan XuAllan Xu
1,78111837
1,78111837
Possible duplicate of How to prevent direct access to API hosted in Azure app service
– MKaz
Nov 13 '18 at 7:45
@MKaz, please see my update.
– Allan Xu
Nov 13 '18 at 17:06
See stackoverflow.com/questions/52173908/…
– Vitaliy Kurokhtin
Dec 3 '18 at 18:46
add a comment |
Possible duplicate of How to prevent direct access to API hosted in Azure app service
– MKaz
Nov 13 '18 at 7:45
@MKaz, please see my update.
– Allan Xu
Nov 13 '18 at 17:06
See stackoverflow.com/questions/52173908/…
– Vitaliy Kurokhtin
Dec 3 '18 at 18:46
Possible duplicate of How to prevent direct access to API hosted in Azure app service
– MKaz
Nov 13 '18 at 7:45
Possible duplicate of How to prevent direct access to API hosted in Azure app service
– MKaz
Nov 13 '18 at 7:45
@MKaz, please see my update.
– Allan Xu
Nov 13 '18 at 17:06
@MKaz, please see my update.
– Allan Xu
Nov 13 '18 at 17:06
See stackoverflow.com/questions/52173908/…
– Vitaliy Kurokhtin
Dec 3 '18 at 18:46
See stackoverflow.com/questions/52173908/…
– Vitaliy Kurokhtin
Dec 3 '18 at 18:46
add a comment |
2 Answers
2
active
oldest
votes
You can enable static IP restriction on your WebApp to only allow incoming traffic from the VIP of your APIM Service facing ( keep in mind in some specific scenarios , the VIP may change and will be required to update the whitelist again).
Clients ==> AAD==> VIP APIM Service <==> (VIP APIM allowed) Web App
https://docs.microsoft.com/en-us/azure/app-service/app-service-ip-restrictions
answered Nov 14 '18 at 3:08
JoleiJolei
1
How do I know the IP range come from APIM? Is there any official IP list for Azure Services in every regions?
– Allan Xu
Nov 14 '18 at 4:05
add a comment |
You can use CORS to define which domain can access your API
See the documentation => https://docs.microsoft.com/en-us/aspnet/core/security/cors?view=aspnetcore-2.1
answered Nov 13 '18 at 17:10
MaxMax
25715
CORS topic is important, but it is not directly related to this question. Because CORS is related to browser to service interaction. But we cannot assume all the requests come from a browser.
– Allan Xu
Nov 13 '18 at 19:14
Can you tell me where it is write that is related to browser? It's not because the first line say that browser have a some-origin policy that CORS is related to browser. It's a server side control. You should really read more. CORS is controlling the DOMAIN origin... that's not related to browser. You just need to put inside yourRegister()inWebApiConfigconfig.EnableCors()and then putting as an attribute[EnableCors('http://www.thedomainyouwant.whatever')]and only calls from this url will be done. CORS allow cross-origin but can be used to same-origin policy as well
– Max
Nov 15 '18 at 13:59
add a comment |
Your Answer
StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53271858%2fhow-to-protect-the-backend-api-against-calls-other-than-azure-api-management%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
2 Answers
2
active
oldest
votes
2 Answers
2
active
oldest
votes
active
oldest
votes
active
oldest
votes
You can enable static IP restriction on your WebApp to only allow incoming traffic from the VIP of your APIM Service facing ( keep in mind in some specific scenarios , the VIP may change and will be required to update the whitelist again).
Clients ==> AAD==> VIP APIM Service <==> (VIP APIM allowed) Web App
https://docs.microsoft.com/en-us/azure/app-service/app-service-ip-restrictions
answered Nov 14 '18 at 3:08
JoleiJolei
1
How do I know the IP range come from APIM? Is there any official IP list for Azure Services in every regions?
– Allan Xu
Nov 14 '18 at 4:05
add a comment |
You can enable static IP restriction on your WebApp to only allow incoming traffic from the VIP of your APIM Service facing ( keep in mind in some specific scenarios , the VIP may change and will be required to update the whitelist again).
Clients ==> AAD==> VIP APIM Service <==> (VIP APIM allowed) Web App
https://docs.microsoft.com/en-us/azure/app-service/app-service-ip-restrictions
answered Nov 14 '18 at 3:08
JoleiJolei
1
How do I know the IP range come from APIM? Is there any official IP list for Azure Services in every regions?
– Allan Xu
Nov 14 '18 at 4:05
add a comment |
You can enable static IP restriction on your WebApp to only allow incoming traffic from the VIP of your APIM Service facing ( keep in mind in some specific scenarios , the VIP may change and will be required to update the whitelist again).
Clients ==> AAD==> VIP APIM Service <==> (VIP APIM allowed) Web App
https://docs.microsoft.com/en-us/azure/app-service/app-service-ip-restrictions
answered Nov 14 '18 at 3:08
JoleiJolei
1
You can enable static IP restriction on your WebApp to only allow incoming traffic from the VIP of your APIM Service facing ( keep in mind in some specific scenarios , the VIP may change and will be required to update the whitelist again).
Clients ==> AAD==> VIP APIM Service <==> (VIP APIM allowed) Web App
https://docs.microsoft.com/en-us/azure/app-service/app-service-ip-restrictions
answered Nov 14 '18 at 3:08
JoleiJolei
1
answered Nov 14 '18 at 3:08
JoleiJolei
1
answered Nov 14 '18 at 3:08
JoleiJolei
1
answered Nov 14 '18 at 3:08
JoleiJolei
1
1
How do I know the IP range come from APIM? Is there any official IP list for Azure Services in every regions?
– Allan Xu
Nov 14 '18 at 4:05
add a comment |
How do I know the IP range come from APIM? Is there any official IP list for Azure Services in every regions?
– Allan Xu
Nov 14 '18 at 4:05
How do I know the IP range come from APIM? Is there any official IP list for Azure Services in every regions?
– Allan Xu
Nov 14 '18 at 4:05
How do I know the IP range come from APIM? Is there any official IP list for Azure Services in every regions?
– Allan Xu
Nov 14 '18 at 4:05
add a comment |
You can use CORS to define which domain can access your API
See the documentation => https://docs.microsoft.com/en-us/aspnet/core/security/cors?view=aspnetcore-2.1
answered Nov 13 '18 at 17:10
MaxMax
25715
CORS topic is important, but it is not directly related to this question. Because CORS is related to browser to service interaction. But we cannot assume all the requests come from a browser.
– Allan Xu
Nov 13 '18 at 19:14
Can you tell me where it is write that is related to browser? It's not because the first line say that browser have a some-origin policy that CORS is related to browser. It's a server side control. You should really read more. CORS is controlling the DOMAIN origin... that's not related to browser. You just need to put inside yourRegister()inWebApiConfigconfig.EnableCors()and then putting as an attribute[EnableCors('http://www.thedomainyouwant.whatever')]and only calls from this url will be done. CORS allow cross-origin but can be used to same-origin policy as well
– Max
Nov 15 '18 at 13:59
add a comment |
You can use CORS to define which domain can access your API
See the documentation => https://docs.microsoft.com/en-us/aspnet/core/security/cors?view=aspnetcore-2.1
answered Nov 13 '18 at 17:10
MaxMax
25715
CORS topic is important, but it is not directly related to this question. Because CORS is related to browser to service interaction. But we cannot assume all the requests come from a browser.
– Allan Xu
Nov 13 '18 at 19:14
Can you tell me where it is write that is related to browser? It's not because the first line say that browser have a some-origin policy that CORS is related to browser. It's a server side control. You should really read more. CORS is controlling the DOMAIN origin... that's not related to browser. You just need to put inside yourRegister()inWebApiConfigconfig.EnableCors()and then putting as an attribute[EnableCors('http://www.thedomainyouwant.whatever')]and only calls from this url will be done. CORS allow cross-origin but can be used to same-origin policy as well
– Max
Nov 15 '18 at 13:59
add a comment |
You can use CORS to define which domain can access your API
See the documentation => https://docs.microsoft.com/en-us/aspnet/core/security/cors?view=aspnetcore-2.1
answered Nov 13 '18 at 17:10
MaxMax
25715
You can use CORS to define which domain can access your API
See the documentation => https://docs.microsoft.com/en-us/aspnet/core/security/cors?view=aspnetcore-2.1
answered Nov 13 '18 at 17:10
MaxMax
25715
answered Nov 13 '18 at 17:10
MaxMax
25715
answered Nov 13 '18 at 17:10
MaxMax
25715
answered Nov 13 '18 at 17:10
MaxMax
25715
25715
CORS topic is important, but it is not directly related to this question. Because CORS is related to browser to service interaction. But we cannot assume all the requests come from a browser.
– Allan Xu
Nov 13 '18 at 19:14
Can you tell me where it is write that is related to browser? It's not because the first line say that browser have a some-origin policy that CORS is related to browser. It's a server side control. You should really read more. CORS is controlling the DOMAIN origin... that's not related to browser. You just need to put inside yourRegister()inWebApiConfigconfig.EnableCors()and then putting as an attribute[EnableCors('http://www.thedomainyouwant.whatever')]and only calls from this url will be done. CORS allow cross-origin but can be used to same-origin policy as well
– Max
Nov 15 '18 at 13:59
add a comment |
CORS topic is important, but it is not directly related to this question. Because CORS is related to browser to service interaction. But we cannot assume all the requests come from a browser.
– Allan Xu
Nov 13 '18 at 19:14
Can you tell me where it is write that is related to browser? It's not because the first line say that browser have a some-origin policy that CORS is related to browser. It's a server side control. You should really read more. CORS is controlling the DOMAIN origin... that's not related to browser. You just need to put inside yourRegister()inWebApiConfigconfig.EnableCors()and then putting as an attribute[EnableCors('http://www.thedomainyouwant.whatever')]and only calls from this url will be done. CORS allow cross-origin but can be used to same-origin policy as well
– Max
Nov 15 '18 at 13:59
CORS topic is important, but it is not directly related to this question. Because CORS is related to browser to service interaction. But we cannot assume all the requests come from a browser.
– Allan Xu
Nov 13 '18 at 19:14
CORS topic is important, but it is not directly related to this question. Because CORS is related to browser to service interaction. But we cannot assume all the requests come from a browser.
– Allan Xu
Nov 13 '18 at 19:14
Can you tell me where it is write that is related to browser? It's not because the first line say that browser have a some-origin policy that CORS is related to browser. It's a server side control. You should really read more. CORS is controlling the DOMAIN origin... that's not related to browser. You just need to put inside your
Register() in WebApiConfig config.EnableCors() and then putting as an attribute [EnableCors('http://www.thedomainyouwant.whatever')] and only calls from this url will be done. CORS allow cross-origin but can be used to same-origin policy as well– Max
Nov 15 '18 at 13:59
Can you tell me where it is write that is related to browser? It's not because the first line say that browser have a some-origin policy that CORS is related to browser. It's a server side control. You should really read more. CORS is controlling the DOMAIN origin... that's not related to browser. You just need to put inside your
Register() in WebApiConfig config.EnableCors() and then putting as an attribute [EnableCors('http://www.thedomainyouwant.whatever')] and only calls from this url will be done. CORS allow cross-origin but can be used to same-origin policy as well– Max
Nov 15 '18 at 13:59
add a comment |
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53271858%2fhow-to-protect-the-backend-api-against-calls-other-than-azure-api-management%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Possible duplicate of How to prevent direct access to API hosted in Azure app service
– MKaz
Nov 13 '18 at 7:45
@MKaz, please see my update.
– Allan Xu
Nov 13 '18 at 17:06
See stackoverflow.com/questions/52173908/…
– Vitaliy Kurokhtin
Dec 3 '18 at 18:46