Making REST calls only available to local applications?

Question

Suppose I have a url like

http://mysite.com/get-users

which returns a JSON object of all users. But, I don't want anyone (or any bots) to be able to go to this url to fetch this information. I want it to only respond to calls from other local modules in the same website.

How would I go about implementing someting like this?

Answer 1

Compare the REMOTE_ADDR against a white list of approved IPs. If it's not in that list, simply return nothing, close the socket, or return an HTTP error.

Answer 2

Hi colorfulgrayscale!

Are you using Spring? Have considered adding a filter bean inside your context to only allow HTTP requests from your site?