10248319-2e2b-4990-bb6b-2ee0708634b4

With 'frontend' do you mean your frontend code?

yes

so this is the api url my frontend is using https://prophesy-backend.railway.internal

Well, international urls are pointing to internal domain names that are resolved by the container runtime

Those aren't publicly accessible

I assume you're trying to connect to that from a browser

I'm hosting my frontend here: https://prophesy-web-production.up.railway.app/
and I want to connect to the backend service

so yes, from a browser

Nope that wouldn't work

can you tell me what I should be doing instead?

I know it doesn't work

Only the SSR part of next wound be able to use internal urls

Umm like, use a public url?

Idk what your requirements tho

is there a way to do it without publicly exposing the backend?

Just to reiterate, what you are saying is that you want your backend to be publicly accessible without being exposed to public

no, I want my backend to only be accessible by my frontend

so you can only make api requests through my website

Then, cors is the answer

U gotta property configure it and then you'll be only able to access ur BE from ur FE domain

ok, do you have any docs on how I can do that?

I'm not familiar with railway

https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS

CORS is not specific to railway at all

But tldr is that you CAN NOT truly prevent anyone online from marking requests to a service that is publicly exposed on the internet

so what url would I reference with cors? and how do I set up my backend service on railway with that

Because if a legit front end domain can access a service, than can anyone else

Unless you use authorization

I thought railway has a feature where the services within a project can access each other, but outside things can't

like a local network thing

Yes railway has it

However

A client's browser is not a service

right

So it cannot possibly be scoped to a private network

so do I keep the public domain with my backend service, and use cors to block requests from other domains?

Private networks make sense when you have services that aren't exposed to public in any way, like a database to backend connection

But backend to frontend only works for the SSR part, not to the browser

That's pretty much how it's done everywhere

You would need to explicitly allow the legit domains and reject requests from any others

yep ok thanks

Again, not railway specific at all, just general web shenanigans

!s