# Only allow update call from frontend canister

**URL:** <https://forum.dfinity.org/t/only-allow-update-call-from-frontend-canister/21936>\
**Category:** Developers\
**Created:** [August 3, 2023, 5:52pm UTC](https://forum.dfinity.org/t/only-allow-update-call-from-frontend-canister/21936 "2023-08-03T17:52:31Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![tcpim](https://sea1.discourse-cdn.com/flex023/user_avatar/forum.dfinity.org/tcpim/32/5916_2.png) [@tcpim](https://forum.dfinity.org/u/tcpim)\
**Post date:** [August 3, 2023, 5:52pm UTC](https://forum.dfinity.org/t/only-allow-update-call-from-frontend-canister/21936/1 "2023-08-03T17:52:31Z")

</div>

I am inspecting the caller in the backend canister `ic_cdk::api::caller()` and try to only allow the frontend canister to make update call. But I found out the caller is always 2vxsx-fae (anonymous).

I don’t want anyone to call the update call directly using canlista or http, but only through frontend. Is there a good way to do this?

This is related [https://forum.dfinity.org/t/can-the-canister-recognize-update-call-is-from-a-frontend-canister/](https://forum.dfinity.org/t/can-the-canister-recognize-update-call-is-from-a-frontend-canister/) but seems there was no good solution back then

---

<div class="post-metadata">

**Author:** ![Berg](https://sea1.discourse-cdn.com/flex023/user_avatar/forum.dfinity.org/berg/32/6678_2.png) [@Berg](https://forum.dfinity.org/u/Berg)\
**Post date:** [August 4, 2023, 6:47am UTC](https://forum.dfinity.org/t/only-allow-update-call-from-frontend-canister/21936/2 "2023-08-04T06:47:45Z")

</div>

Bump for visibility!

---

<div class="post-metadata">

**Author:** ![Vivienne](https://sea1.discourse-cdn.com/flex023/user_avatar/forum.dfinity.org/vivienne/32/29170_2.png) [@Vivienne](https://forum.dfinity.org/u/Vivienne)\
**Post date:** [August 4, 2023, 9:07am UTC](https://forum.dfinity.org/t/only-allow-update-call-from-frontend-canister/21936/3 "2023-08-04T09:07:05Z")

</div>

> [@tcpim](#):
>
> This is related [https://forum.dfinity.org/t/can-the-canister-recognize-update-call-is-from-a-frontend-canister/](https://forum.dfinity.org/t/can-the-canister-recognize-update-call-is-from-a-frontend-canister/) but seems there was no good solution back then

This is still the state of the art, and I don’t see this changing any time soon