title: How to secure client app (react) and API communication
body: <p>I have a client side React application and a Rails API from which the React app is fetching data.</p>
  
  <p>As you would expect I only want my React application to be able to fetch data from the API and the rest of the world shouldn't be able to receive data from it. </p>
  
  <p>Despite much searching I am yet to find the best way to secure the communication between the two applications. </p>
  
  <p>I have read about JWT tokens and cookie based session authentication but the majority of articles seem to be focused on authentication of users (ie sign in/sign out) rather than communication between just the two applications. </p>
  
  <p>The two apps will share the same domain so is it enough to rely on Cross Origin to secure communication?</p>
  
  <p>Any advice really would be much appreciated.  </p>