node js allow access only from frontend - node.js

Question

I'm trying to allow access only from my frontend and to restrict all others access from direct URL on API/postman and other things. I saw some examples here but I couldn't solve this thing.. This is my currently app.js:
const fs = require('fs');
const path = require('path');
const express = require('express');
const bodyParser = require('body-parser');
const mongoose = require('mongoose');
const companiesRoutes = require('./routes/companies-routes');
const usersRoutes = require('./routes/users-routes');
const adsRoutes = require('./routes/ads-routes');
const HttpError = require('./models/http-error');
const app = express();
const http = require('http').Server(app);
const io = require('socket.io')(http);
app.use(bodyParser.json());
const cors = require('cors');
const corsOptions ={
origin:'http://localhost:3000',
credentials:true,
optionSuccessStatus:200
}
app.use('/uploads/images', express.static(path.join('uploads', 'images')));
app.use('/uploads/videos', express.static(path.join('uploads', 'videos')));
app.use('/uploads/videos/thumb', express.static(path.join('uploads', 'videos/thumb')));
app.use((req, res, next) => {
res.setHeader('Access-Control-Allow-Origin', '*');
res.setHeader(
'Access-Control-Allow-Headers',
'Origin, X-Requested-With, Content-Type, Accept, Authorization'
);
res.setHeader('Access-Control-Allow-Methods', 'GET, POST, PATCH, DELETE, PUT');
next();
});
app.use('/api/companies', companiesRoutes);
app.use('/api/users', usersRoutes);
app.use('/api/ads', adsRoutes);
app.use(cors(corsOptions))
app.use((req, res, next) => {
const error = new HttpError('Could not find this route.', 404);
throw error;
});
app.use((error, req, res, next) => {
if (req.file) {
fs.unlink(req.file.path, err => {
console.log(err);
});
}
if (res.headerSent) {
return next(error);
}
res.status(error.code || 500);
res.json({ message: error.message || 'An unknown error occurred!' });
});
and last mongoose.connect etc.
Maybe I did something wrong here but I cant realize where's the problem in this code. I got this example about CORS here from other topic but it didn't solve my problem.

Answer 1

Try this:
const fs = require('fs');
const path = require('path');
const express = require('express');
const bodyParser = require('body-parser');
const mongoose = require('mongoose');
const companiesRoutes = require('./routes/companies-routes');
const usersRoutes = require('./routes/users-routes');
const adsRoutes = require('./routes/ads-routes');
const HttpError = require('./models/http-error');
const app = express();
const http = require('http').Server(app);
const io = require('socket.io')(http);
app.use(bodyParser.json());
const cors = require('cors');
var corsOptions = {
origin: 'http://localhost:3000',
optionsSuccessStatus: 200, // For legacy browser support
methods: "GET, PUT" // add per need
}
app.use(cors(corsOptions));
app.use('/uploads/images', express.static(path.join('uploads', 'images')));
app.use('/uploads/videos', express.static(path.join('uploads', 'videos')));
app.use('/uploads/videos/thumb', express.static(path.join('uploads', 'videos/thumb')));
app.use('/api/companies', companiesRoutes);
app.use('/api/users', usersRoutes);
app.use('/api/ads', adsRoutes);
app.use((req, res, next) => {
const error = new HttpError('Could not find this route.', 404);
throw error;
});
app.use((error, req, res, next) => {
if (req.file) {
fs.unlink(req.file.path, err => {
console.log(err);
});
}
if (res.headerSent) {
return next(error);
}
res.status(error.code || 500);
res.json({ message: error.message || 'An unknown error occurred!' });
});
Note: Visit this link Handling CORS with Node.js if you interest a more better way to work with CORS