title: Securing RESTful API: Is it possible to disallow XHR requests from the JS Console?
body: <p>My application (mostly client-side code written in backbone) interfaces with a Node.js server.  The sole purpose of my server is to provide API endpoints for my backbone application.</p>
  
  <p><code>GET</code> requests are pretty safe, attackers can't do much here. But I do have a few POST and PUT requests. One of the <code>PUT</code> requests is responsible for updating vote count for a particular user, e.g. </p>
  
  <pre><code>app.put('/api/vote`, function(req, res) {
    // POST form data from the client
    var winningPerson = req.body.winner; // userID
    var losingPerson = req.body.loser;   // userID
  }
  </code></pre>
  
  <p>I have noticed that some people were just spamming <code>PUT</code> requests for one particular user via JS console or some kind of REST API console, bypassing the intention of the application enforced by the User Interface. If you were to use this application as it is intended, it would never allow you to vote for the same person multiple times in a row, let alone any arbitrary user from the database (assuming you know their user id).</p>
  
  <p>But yes, yes I know: "<em>Don't trust the client</em>". <strong>So how can I fix the above problem?</strong> Will some kind of <em>IP address</em> checking help here to prevent voting multiple times within a span of 3-5 minutes? <strong>What can I do to disallow access to my API from the console so that users cannot arbitrarily vote for anyone they wish</strong>, but instead only vote by clicking on an image with a mouse, or at the very least vote from console just for those two people, not any arbitrary person?</p>