Question

I have the following architecture for my app:

jQueryMobile web app –> Gets JSON from —> REST API created in C#

I have placed the REST API Code in a virtual directory in IIS 6.
The Mobile site code is running in the root of the website… so the rough file structure is like this:

inetpub/

    /index.html
    myjavascript.js

    /restapi/
      web.config
      Global.asax
      bin/(bunch of Dlls...)

The Server is behind a network with the following sort of IP translation (not the real IPs…)
For example:

Web Server external IP:  121.131.141.50  (with URL http://mysite.com/)
Internal IP:             10.210.2.5
Subnet:                  255.255.255.0

I have tried restricting access to the restapi folder by IP as I would like for it only to be accessible from the web server. I have tried the IIS approach and set Directory Security settings, and have also tried the approach of using a ServiceAuthorizationManager class to check Request IP in the Http Request.
Both approaches gave me the same result: There was no problem restricting and testing the actual service call through Fiddler to prove that a 401 would be thrown from any IP other than the web server IP: 10.210.2.5. I was also able to execute it from the webserver (which is the desired setup).

However, once the Mobile site javascript calls it, I get the 401 unauthorized. As the Javascript code is client side, the restapi assumes that the call is coming from the Client’s IP address, which of course, is blocked.

Is there a neat way to check that the call comes from the IP where JavaScript is sitting?

Or Is there a better way to go about the whole thing?! :-/ Is there a way to make the web app specifically permitted to access the restapi virtual directory ?

Answer 1

Back to basics, your setup looks like this:

client    <---->    web server
           HTTP

The web server hosts files which can be requested from outside by clients over the HTTP protocol. The web server is also where you filter incoming requests:

client    <---->    | web server
           HTTP     |
                 IP filter

If you say you want the REST service to be only accessible “on the same server”, that means this:

client    <---->    web server
           HTTP     ^    |
                    |    |
                    +----+
                     REST

But if the server is only talking to itself, you don’t really need a full-blown REST interface to begin with. I guess what you actually mean is that the client, which downloads HTML and Javascript form the server, may request additional data from the server via REST.

client    <---->    web server
           HTTP

          <-------
        HTML, JS files

       -------->
           AJAX

But as you see, the way it works is that the client downloads Javascript files from the server and executes that Javascript locally which then sends AJAX requests back to the server. The requests will always come from the client. They have to. It does not matter where the Javascript code that is making those requests originally came from. It could be a script from your server or it could be hand-typed by the user. An AJAX request is an HTTP request is an HTTP request like any other. Either you make your REST service accessible from outside or not, you cannot filter by the code that generated the request.

If you want to make the API non-public, require authentication so only registered users can access it. That doesn’t make the API itself any less publicly accessible though.