title: Mechanism to secure a private internal web api from public access
body: <p>I have a java application consisting of a static HTML page and JS. In the application I have REST-like API which is called by JS from static HTML. In front of the application is a front-end proxy server, say Nginx or Apache.
  the front-end server is located on server S1 and servlet container is located on server S2.</p>
  
  <p>I have a page <a href="http://example.com/mycontext/page.html" rel="nofollow">http://example.com/mycontext/page.html</a> which includes the JS file invoking REST API located at <a href="http://example.com/mycontext/api/someresource" rel="nofollow">http://example.com/mycontext/api/someresource</a>
  The front-end passes all request matching <a href="http://example.com/mycontext/" rel="nofollow">http://example.com/mycontext/</a> to my application.</p>
  
  <p>I want to introduce another web api in my application for internal use only, i.e. this new api should be invoked and visible only by other applications in my intranet (say from server S3), not from the internet.</p>
  
  <p>I want this api to be HTTP-based, WS or REST-like, and to be managed by the same servlet container, say Tomcat, in which my app is deployed.</p>
  
  <p>What options do I have?</p>