How do I limit access to my Netlify Serverless function

Question

I've searched the netlify docs and I can't figure this out.

I have a serverless function located here

/.netlify/functions/orderCreate

But I can hit this in my browser or with curl and it tries to create an order. If an attacker finds out about this function they could create thousands fake orders in my db.

I know I can do some simple checks like make sure it is a HTTP post, or make sure it has some valid session ID but I would really like some type of auth or better security.

Because all requests should come from the a client side react app via an ajax request can I limit it to the same domain or something ?

Answer 1

As Netlify doesn't provide a way to check and specific requests based on origin, you could do it manually from inside your function's code and send a 403 response if the Origin isn't your client-side domain:

exports.handler = function(event, context, callback) {
    if (event.headers["Origin"] !== "https://whateverisyourdomainname.netlify.com")
        return callback(null, { status: 403 })

    // else, do whatever your function does
}

Recent browsers do prevent a user from setting the Origin header himself. However, nothing prevents anyone to craft a curl request and to spoof the Origin header to hit your function. If you wish to really prevent it, you should set-up a proper authentication process to your application.