title: How to prevent non-browser clients from sending requests to my server
body: <p>I've recently deployed my website and my back-end on the same vps, using nginx, but now when I do a request with PostMan to <a href="http://IP:port/route" rel="nofollow noreferrer">http://IP:port/route</a> - I get the response from the server from any PC.
  I think this not how its suppose to work. I set the CORS options to origin : vps-IP (so only my domain), but my server still accepts the requests from PostMan. Is there any way to prevent my back-end from accepting these requests limiting the domain to only my domain AKA my vps ip? And must the requests bypass nginx first?</p>
  
  <p>Another question is to protect my website; important request and response headers are showing in the browser network tab - like Authorization JWT token, is this normal or is this some security risk?</p>