in a production app, we’d need to include a proxy for the API calls for DDOS protection, other security measures, etc. For example ,ngrok would be one example of products like this.
Or do you usually use a CDN (cloudflare) for this, and use their proxy capabilities built in through the CDN side?
How would this be done with Apex?
Apex Designer generate pass that are Angular apps served from a container running LoopBack.io Node.js inside. You would protect these the same way you protect any other containerized app via capabilities of your hosting environment.
