Initially, there seems to be a misconception about how requests to your API function. When your react application communicates with the server on port 8000 from port 3000, it is simply an incoming request without a specific origin tied to port 3000. The inbound port number will typically be randomly generated with either 5 or 6 digits. Outbound ports are dynamically assigned by the TCP system and do not reveal the originating application.
In addition, your RESTful API server acts as a public endpoint accessible to anyone. While you can implement cross-origin protections to restrict JavaScript requests to specific domains, other non-browser requests cannot be controlled in the same manner.
Hence, any individual proficient in coding using tools aside from browsers can interact with your API. Larger entities like Google often mandate an APIKey issued to users or require login credentials (such as cookies) to verify permitted access. Nonetheless, this does not guarantee exclusive usage by your application; prevention of external access is nearly impossible.
The common practice involves enforcing login credentials or APIKeys while monitoring API activity patterns. Permissible use is determined based on the nature and frequency of requests, whereas improper usage may result in temporary or permanent blocking of the user or credential in question.
For instance, suppose I have a POST route at mydomain.com/signup. How can I prevent unauthorized usage through external sources like Postman?
Unfortunately, achieving absolute restriction is challenging. Despite implementing measures, such as introducing expiring tokens within web pages and validating their usage in API requests, skilled individuals can still extract and misuse these tokens for accessing the API programmatically.
What strategies can I employ to restrict access to my RESTful routes exclusively to my mobile app and website?
Regrettably, complete exclusivity is unattainable due to the inherent nature of web APIs being publicly available. Any entity possessing the requisite credentials can potentially utilize the API regardless of intended restrictions.