Adding URL parameter based on user's attribute - where should this be implemented?

[#1]

I have an UI5 app which calls an external user API.

I want to add URL parameter "company" to limit the record displayed to the user for authorization purpose. "company" is determined based on an attribute assigned to the user's role.

However, calling the API directly from the UI is not safe, as the user can get the API URL from the network tab and call the API directly from the browser without company parameter added.

So, the next idea is to create a proxy app that retrieves user's attribute and adds company parameter.

This would work, but creating a proxy app purely for adding an URL parameter seems overkill. Is there a better way to achieve this? For example, can API Management be used for this purpose?

Thanks,

Mio

[nicoschoenteich]

I recently faced a similar situation and wrote a blog post about the solution I found: https://blogs.sap.com/2022/03/10/ui5-apps-and-api-keys-a-secure-way/comment-page-1/#