Secure Cloud Run service to accept requests from a Domain in Browser only (and not Postman / shell script)

Question

We have gone through the authentication overview but it doesn't answer our question so reaching out to the experts here.

Our web application once loaded on the browser for a user makes requests to our service on Cloud Run. We would like to secure our backend service so only our Domain can access this and not some user using Postman, or a shell script to access / update data.

end-user-access auth

Because the user doesn't have to be always signed in, we would like Cloud Run to respond to the requests, even if there's no auth token present. This eliminates the end-user access to service option for us.

service-to-service auth:

Because it is the browser, and not another service in our GCP platform that's making the request, even this option doesn't work for us.

The user data in our backend is secure, because those end points require Auth tokens, however, pages that don't need auth token are insecure, and could be vulnerable to DDOS or bot/scraping attacks.

How can we secure our Cloud Run service so only calls from our Web Application are responded to and not others?

Answer 1

You can't be sure that the web application is the sender of the request. Indeed, in the web environment, you send your code on the client side. From here, the users (good or bad) can go into your code and understand how it works, what are the header of the request, how these headers are built,...

Complex, and inefficient things can be imagined... Maybe, the best way is to plug an API Gateway and to perform rate limit for the users. Like this, even if the user uses an automated thing, they will be limited. I wrote an article on the Cloud Endpoint Rate limit. Not sure that is the best product for this, maybe Apigee can fit better your requirements.

EDIT

What I would like to say in the first paragraph is "it's not possible with Cloud Run and with any other web technology".