John Davidson

Message:

I am using symfony 5 and LexikJWTAuthenticationBundle to authenticate users. everything works and I receive the token but I would like to ensure that only my mobile application can access the API. is it possible to secure the api with a key or a hash in addition to the JWT? Thank you.

---

My Answer:
Yes, it is possible to secure your API endpoints in addition to using JWT authentication. One common approach is to implement API key authentication.

You can generate a unique API key for your mobile application and require that the key be included in the request headers when making API calls. This way, only requests with the correct API key will be allowed to access your API endpoints.

Here's a basic example of how you can implement API key authentication in Symfony:

1. Generate a unique API key for your mobile application.
2. Create a custom authentication listener that checks for the presence of the API key in the request headers.
3. If the API key is present and valid, allow the request to proceed. If not, deny access.

You can also combine API key authentication with JWT authentication for an added layer of security. This way, both the API key and JWT token must be present and valid for the request to be allowed.

Remember to keep your API key secure and never expose it in client-side code or public repositories. Additionally, consider rotating your API key periodically for added security.