title: Prevent direct api access from browser
body: <p>Currently as it stands, if a user reads the source of my web application, they'd be able to determine the direct URIs of all the RESTful services my web application utilizes.</p>
  
  <p>The problem I see is this: My web application knows how to correctly use the API, and I might not have thought of every single validation known to man to prevent bad data from being sent through the API. </p>
  
  <p>And so with that is there a method to prevent "direct" access to the API and limit it only to my web application?</p>
  
  <p>P.S. As an FYI: API calls concerning a user are protected by the presence of a user-specific cookie which is only issued upon login. This means I'm not too afraid of User X being able to directly modify User Y's data through the API.</p>