How to communicate securely between shell app and micro application(frontend) via pubsub

Question

I have a shell application which is the container application that performs all the API communication. Also, I do have multiple Micro application which just broadcast the API request signal to shell application.

Now, keeping the security in mind, as a shell application how it can ensure that API request signal is coming from the trusted micro app which I own.

To be very precise, My ask is, is there a way to let shell application know that the signal is coming from the micro app that it owns and not from any untrusted(like hacking, XSS) source

Answer 1

As per the Micro-Frontend architecture each Micro Frontend should make call to it's own API (micro service). However, your Shell app can provide some common/global library which can help the Micro Frontends make the AJAX call. But the onus of making the call must remain with the individual micro frontend.

Answer 2

From your question it is unclear if your apps are running in iframes, or are being loaded directly into your page.

In the case of iFrames your using postMessage and you can check the origin on received message via event.origin. Compare this with a list of allowed domains.

If your micro apps are directly on your page then you just control what is allowed to load into them.