Create a secure layer to hide web service from non-authenticated users, in an React App - node.js

Question

I'm working in a React application that basically resets the password to non authenticated users. The problem is, in order to do that with Ajax, I'm exposing the service url (which is not secure, and I can't work over that, since that part of the project belongs to other company).
My idea was (I've never done this before so I'm not sure this is the way to go) to create some sort of REST service in the middle that "hides" the real service from the user, so I call it and "he" calls the actual server, giving me the data I need.
But, I need to secure this new service so only my app can use it, right?. If this is a good way to do it, how can I implement this with non authenticated users?. If don't, what can I do to solve this problem?
I'm open to any ideas, I was planning to use Node.js but I have zero experience with this particular matter.
Any help is very welcome, thanks in advance!

Answer 1

If you cant make any changes in the existing service and it lies in non secure env, then your thinking is correct. Its better to create a REST service which is called from UI, and that REST service in turn should call your existing service.
Now, if you dont have any feature to authenticate user, then I'm not sure how you can make that REST service secure. Even if you create a REST service, it wont solve your purpose if you dont have any means in place to authenticate user. Even that REST service will be exposed and wont solve your purpose.
If you have a functionality to authenticate user, like creating a session or capturing some details initially before you call this service or a login screen etc, which will serve as a way to verify user before you access other services, then you have a solution.

Answer 2

If you need to authenticate the users, the most current practice is to use e-mails - assuming that only the user has access to his email. (this is also the cheapest one).
When you generate the url is when you need to be careful. Basically, you need to ensure that it is unique, not publicly published, and associated with a particular user - for a short amount of time. The common and most straight-forward way to do it is by appending tokens to the url. Now, there are several crypto requirements connected to the token generation, I would advice not creating your own code for this functionally. As an example of one time use token, we can check https://www.rfc-editor.org/rfc/rfc6750.
However, as you tagged Liferay on this thread, you could consider using the UserLocalService to generate the emails.
Or get inspiration from this code for URL generation:
Date expirationDate = null;
if ((passwordPolicy != null) &&
(passwordPolicy.getResetTicketMaxAge() > 0)) {
expirationDate = new Date(
System.currentTimeMillis() +
(passwordPolicy.getResetTicketMaxAge() * 1000));
}
Ticket ticket = ticketLocalService.addDistinctTicket(
companyId, User.class.getName(), user.getUserId(),
TicketConstants.TYPE_PASSWORD, null, expirationDate,
serviceContext);
StringBundler sb = new StringBundler(6);
sb.append(serviceContext.getPortalURL());
sb.append(serviceContext.getPathMain());
sb.append("/portal/update_password?p_l_id=");
sb.append(serviceContext.getPlid());
sb.append("&ticketKey=");
sb.append(ticket.getKey());
passwordResetURL = sb.toString();