javascript - Dumb question: Concern regarding using backend server's REST API in React app

Question

Like in order to connect(basically making request's) our React app to our backend server we have to use backend REST API, like logging in user, fetching data from the backend.

But wouldn't using REST API on the React components make API available to every user and any malicious mind could create chaos or make unnecessary requests to the server(like using Postman).

Is there any way to hide API keys, I've seen another answer to a similar question on 'How to hide API Keys' but there's not a clear answer, some saying to prepend API with REACT_APP_ in a dotenv file but some saying this is not safe, although I've tried prepending REACT_APP_ but still API is visible on the front end.

Is there a solution available to this problem?

标签： javascriptnode.jsreactjsapirest

Answer 1

在您的 react 应用程序中使用 REST API 不会向公众公开这些端点。凭借现有的 REST API，这些端点已经向公众公开，公众中的任何人都可以使用它们。确保这些端点被锁定和安全（需要身份验证等）是服务器的工作，而不是客户端。