# Secure api requests from react to django backend

**URL:** <https://community.auth0.com/t/secure-api-requests-from-react-to-django-backend/89453>\
**Category:** Get Help\
**Tags:** django, react\
**Created:** [August 25, 2022, 5:28pm UTC](https://community.auth0.com/t/secure-api-requests-from-react-to-django-backend/89453 "2022-08-25T17:28:04Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![k.impolevicius](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/k.impolevicius/32/39537_2.png) [@k.impolevicius](https://community.auth0.com/u/k.impolevicius)\
**Post date:** [August 25, 2022, 5:28pm UTC](https://community.auth0.com/t/secure-api-requests-from-react-to-django-backend/89453/1 "2022-08-25T17:28:04Z")

</div>

I have web app. This consist of services deployed on Docker engine. The main services/containers are:

- Frontend : React on Nginx web server
- Backend (API) : Django, DRF on gunicorn on Nginx

For frontend I use Auth0. It works as expected. If user is not authenticated/authorized it is redirected to login page.

Now I want also to “secure” my backend that it only would accept authenticated connections from frontend.  
For backend (Django) I also have CORS enabled (django-cors-headers package), but I still can connect from my browser my-site/api/ and get the response.  
How should I secure my requests?

---

<div class="post-metadata">

**Author:** ![ty.frith](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ty.frith/32/58484_2.png) [@ty.frith](https://community.auth0.com/u/ty.frith)\
**Post date:** [August 26, 2022, 10:44pm UTC](https://community.auth0.com/t/secure-api-requests-from-react-to-django-backend/89453/4 "2022-08-26T22:44:48Z")

</div>

Hello @k.impolevicius and welcome to the community!

> [@k.impolevicius](#):
>
> How should I secure my requests?

Great question! This is typically achieved by creating an access token to be validated by your backend - The following resources should be helpful in steering you in the right direction:

> **[Single-Page Applications (SPA) with API](https://auth0.com/docs/get-started/architecture-scenarios/spa-api)**
>
> Explains the architecture scenario where a single-page application (SPA) talks to an API using OpenID Connect (OIDC), and the OAuth 2.0 Implicit Grant Flow, to authenticate users with Auth0.

[https://auth0.com/docs/microsites/protect-api/protect-api](https://auth0.com/docs/microsites/protect-api/protect-api)

> **[React with React Router 6 (TypeScript) + Django (Python) Code Sample: Basic...](https://developer.auth0.com/resources/code-samples/full-stack/hello-world/basic-access-control/spa/react-typescript/django-python)**
>
> See full-stack authentication and authorization in action using Auth0, React (TypeScript) using the React Router 6 library, and Django (Python). This Auth0 "Hello World" code sample demonstrates basic access control in a full-stack system.

Hope this helps!

---

<div class="post-metadata">

**Author:** ![ty.frith](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ty.frith/32/58484_2.png) [@ty.frith](https://community.auth0.com/u/ty.frith)\
**Post date:** [September 10, 2022, 10:45pm UTC](https://community.auth0.com/t/secure-api-requests-from-react-to-django-backend/89453/5 "2022-09-10T22:45:32Z")

</div>

This topic was automatically closed 15 days after the last reply. New replies are no longer allowed.