Secure Netlify Functions

[tysonalcorn]

Is there a way to secure Netlify functions in such a way that only the site itself can access them? I’m building a B2B SaaS and one of the requirements of the project is that each customer must have its own database and the users of each customer must be stored and authenticated in/from that database (which means I can’t use Netlify identity). To do this, I created a Netlify lambda function that creates a skeleton database off of a pre-built schema when the customer signs up. However, I need to secure this function so that only the application and no one/nothing else can access and use it. Does anyone have any idea?

Thank you kindly!

-Tyson

[jen]

Hey @tysonalcorn,
Our signed proxy redirects should work this. Here’s a thread discussing them:

Verify user in Node.js backend

Hi @jonathan-fielding, You can verify the signature of our JWT’s in a Netlify function. In fact if you pass an Identity JWT in as a bearer token in an Authorization header, we’ll verify for you automatically and inject the user data in to the functions context. From there you can actually run some logic with that data or sign a new JWT and send it to your own backend. Another option is to use JWS with netlify redirects so that you can confirm that the request comes Netlify directly. You can rea…

And our docs on them:

Rewrites and proxies

Let us know if that helps or if you have any other questions!

[payzanto]

Hi Jen! It’s not clear to me how signed proxy redirects help here. I read through the documentation and I’m still confused. I have a basic Netlify function but I only want my site to be able to access it. How can I do that?

[payzanto]

I found [Support Guide]: How to apply Access Control for Netlify Functions?, I think this is what I’m looking for.