Q:

How should I handle a scalability problem during routing my requests from server?

I have faced a problem with the initial design of my system where sensitive information was being sent to the front-end and front-end was responsible for calling 3rd party APIs. As you have probably guessed it was extremely vulnerable to attacks. To remedy this I added a back-end system to proxy those requests and call the 3rd party APIs on behalf of front-end. The issue with this approach is it is not scalable at all. I am currently looking at additional 15 servers to handle the current load and it is increasing day by day.
Any advice on how can I remove this back-end requirement? is there any way to make the front-end still call the APIs but secure the data?

A:

No. It goes from very difficult (secured client with online executable validation) to impossible (browser).
This is strangely vague for some reason, but if it is a web platform and someone tried to use Javascript, then it is very much impossible.
If it is a custom client that you have full control over, then you'll need to do a self-validation that is checked online to make sure code is not modified. Even then, the network traffic can be attacked so that scenario is still vulnerable. You can then setup VPN connections from the client but the overhead goes up.

A:

Tokens
Depending on your collaborating third-parties you could use a token system.
User Obtains a suitable permission restricted, and signed token from your server.
They use this token to talk to the third-party services.
The third party services verify the integrity of the token with you, alternately you already cleared the path with the third-party.
You will have to ensure that the token can only perform the operations you are fine with them doing on the third-party directly. That it has a short expires (say 20mins). And that it does not reveal any secret information.
Note that you have to presume that any barriers erected in the client to prevent an operation, do not exist when considering this approach. The user can do any mutative, or query action at any time. The token permissions must be set to ensure that only the mutations that are acceptable, and the data that is fine for public dissemination is returned.
Which does mean that very dangerous operations should still be proxied by your own services, if only to ensure you have an audit trail. And dangerous doesn't just mean deletion, creation, and meta-data changes also fit this mold.

