Hello,
We have four React Vite-based websites:
https://www.production.demo.com
https://www.production.googleteam.demo.com
https://www.production.items.demo.com
https://www.production.card.demo.com
All of these websites use a single Node.js backend.
We have implemented some basic security features such as CORS origin restrictions. However, these measures are currently not sufficient, as we’ve noticed that some users are able to access our APIs using tools like Postman or other HTTP clients by bypassing the origin check.
We’re looking for suggestions on how to further secure our APIs and prevent unauthorized access.