title: How to make sure that my AJAX requests are originating from the same server in Python
body: <p>I have already asked a question about IP Authentication here:  <a href="https://stackoverflow.com/questions/21708113/tastypie-authentication-from-the-same-server">TastyPie Authentication from the same server</a></p>
  
  <p>However, I need something more! An IP address could be very easily spoofed. </p>
  
  <p><img src="https://i.stack.imgur.com/5xDVy.png" alt="enter image description here"></p>
  
  <p><strong>Scenario:</strong> My API (TastyPie) and Client App (in javascript) are on the same server/site/domain. My users don't login. I want to consume my API in my javascript client side.</p>
  
  <p><strong>Question:</strong> How can I make sure (authentication) that my <strong>AJAX requests</strong> are <strong>originating from the same server</strong>? </p>
  
  <p>I'm using Tatypie. I need to authentication that the requests from the client are being made on the same server/domain etc. <strong>I cannot use 'logged in sessions' as my users don't login.</strong> </p>
  
  <p>I have looked at <strong>private keys and generating a signature</strong> but they can viewed in the javascript making that method insecure. If I do it in a way to request a signature form the server (hiding the private key in some python code) anyone can make the same http request to <code>get_signature</code> that my javascript makes, thus defeating the point.</p>
  
  <p><img src="https://i.stack.imgur.com/QWijj.png" alt="example get signature"></p>
  
  <p>I also tried to have the Django view put the signature in the view eliminating the need to make the get_signature call. This is safe, but means that I have to now refresh the page every time to get a new signature. From a users point of view only the first call to the API would work, after which they need to refresh, again pointless.</p>
  
  <p><img src="https://i.stack.imgur.com/xNOyH.png" alt="using Django for the signature"> </p>
  
  <p>I cannot believe I'm the only person with this requirement. This is a common scenario I'm sure. Please help :) An example using custom authentication in Tastypie would be welcome too. </p>
  
  <p>Thanks</p>
  
  <p>Added:</p>