Re: From the PowerApps portal, how to securely talk to an external API hosted in Azure?
Hi @Anonymous,
This implementation does mostly use JavaScript - from the Portal end. Note that the biggest issue with JavaScript API in the Portal is that you're making everything, including authentication, accessible to a tech-savvy user. For example, if you just pass a username & pass or static credentials to an API from JavaScript, I can easily press F12 and see what you did. Then I can manipulate the data, or throw it into a whole bunch of virtual machines and try to throw thousands of requests at your API, all to try to break the API.
The advantage of the documentation shared is that it relies on generating a coded API request only when the Portal has been setup to make a request to that particular API. But that's only half the problem - now the API needs to decode it. This is where the C# comes in - you need to be able to retrieve the decoding pattern from the Portal, apply it to the coded message, and if everything decodes without breaking then you can guarantee the request came from the trusted source.
