Implement API Security Layer (CORS + API Keys + Throttling)

[jodaz]

Problem Description

The application is currently deployed using Expo (Web) and hosted on GitHub Pages. This architecture creates a specific security challenge:

• Static Hosting Limitation: Unlike server-side rendered applications, GitHub Pages is purely static and cannot hide secrets or proxy requests.
• Exposure of Endpoints: The backend API URL and any associated Keys are embedded in the JavaScript bundle.
• Unauthorized Access: Without a middle layer, malicious actors can easily identify endpoints and perform unauthorized requests or scraping.

Proposed Solution

Implement a multi-layered security strategy in the NestJS Backend:

1. Strict CORS: Accept requests only from https://nootraappdeldolar.jodaz.xyz and authorized origins.
2. Multi-Tier API Key System:
   • Tier 1 (Public): For the GitHub Pages site, restricted by CORS and tight Rate Limits.
   • Tier 2 (Authorized): For third-party server-to-server integrations with higher quotas.
3. Throttling: Use @nestjs/throttler to limit requests based on IP and API Key.
4. WAF Layer: Integration with Cloudflare for DDoS protection.

Implementation Steps

• Configure main.ts with strict CORS.
• Install and configure @nestjs/throttler.
• Implement ApiKeyGuard in a new AuthModule.
• Update frontend to include X-API-KEY header.
• Configure Cloudflare Firewall rules.