HTTP Basic Authentication

https://docs.konghq.com/plugins/basic-authentication/

https://docs.nginx.com/nginx/admin-guide/security-controls/configuring-http-basic-authentication/

Never expose web app directly to the world.
Put Kong or nginx before it and enable Basic Auth for extra security.

-o-