How to secure Slim Rest API by allowing only certain domain?

5

Hello @mahesh,

Below is an example using middleware:

$app = new \Slim\App();

// adding middleware to all requests to check the domain of the client
$app->add(function ($req, $res, $next) {
    if ($_SERVER['REMOTE_ADDR'] !== 'example.com') {
        // domain not allowed, return 403 Forbidden response
        return (new Slim\Http\Response())
		        ->withStatus(403)
		        ->withJson(['error' => 'access denied']);
    }

    return $next($req, $res);
});

$app->get('/', function ($req, $res) {
  return $res->withJson(['message' => 'success']);
});

$app->run();

If you are looking for existing middleware, you may want to look at https://github.com/oscarotero/psr7-middlewares#firewall

Note that you can also restrict access by configuring your web server, for example with access control in Apache.