title: filter requests on nginx server when it serves as both http server and reverse proxy
body: <p>I have an nginx server serving both as an http server (frontend) on / and reverse proxy on /api, where it forwards the requests to a node server (backend) on the same machine (localhost).</p>
  <p>I am using authentication only on the frontend. The backend accepts all incoming requests and does not authenticate again the requests.</p>
  <p>I would like to allow all requests coming from the frontend to the backend. I would like to block all requests coming to the backend from other sources (via the reverse proxy of course).</p>
  <p>For example, the frontend will try to login the user using the user third-party auth id via https://domain/api/login/id. The reverse proxy will forward it to the backend. This is fine.</p>
  <p>I can also access the backend directly from any other machine via https://domain/api/login/id.</p>
  <p>My question is the following. I would like to block all requests not originating by the frontend. I have tried figuring out how to find the information but it seems that the X-Real-IP header always refers to the browser originating the request (either by using the frontend or directly). I am wondering if there is any header I can set in the reverse proxy which will tell the backend that this is an allowed call, or even use nginx own allow/deny rules. Right now, I do not manage to make a distinction between the two types of requests.</p>
  <p>Thank you very much!</p>