title: Public Facing Web Service Security - Internal Requests
body: <p>I have a public facing web service that has a token based security system.  Log in is accomplished by providing a username &amp; password and a unique token is returned that is used going forward whenever the service is called.</p>
  
  <p>My question is this: Is there a secure way to differentiate between a call coming from outside our internal network and a call coming from within?  I would like to provide elevated privileges to clients that are calling the service from within our internal network.  Specifically we have a website running on the same network as our webservices and I would like to give the website elevated privileges when calling our service.</p>
  
  <p>Is there a secure way to do this when the web service is public facing?  What I don't want to happen is that someone from outside our internal network to somehow get access to elevated privileges.</p>
  
  <p>The services were implemented using Java and the CXF framework.</p>