Host a webapi in IIS Express so it can only be accessed by a parent web application

Question

I have 2 separate webapi apps and I want the 1st one to be a normal webapi app which can be accessed by any authorised over the internet. With the 2nd one, I need it to not be publicly accessible and only available to the 1st (so the 2nd app is 'nested' within the first somehow). Could anyone please tell me how I can achieve this (the apps are hosted in IIS Express at present but will be in iis for production)? Many thanks

Answer 1

If you're concerned about security (and everyone should be), you can configure IIS to allow only specific computers, groups of computers or domains access to your Web site. Here's the procedure:

1)Open the IIS console and go to the Properties of your Web site.

2)double-click IP Address and Domain Restrictions.

3)Click Add Allow Entry... (on the right pane) to add an IP address or IP address range which will be allowed to access the website. Click OK. Repeat this step to add other IP addresses to the list.

Once allowed IP addresses have been added, click Edit Feature Settings... and select Deny for Access for unspecified clients. Click OK.

Now, only users with the specified IP addresses are able to access the website.