title: nodejs / express: safe way to check if a request comes from same domain
body: <p>I have a nodejs / express application that server some <code>html</code> pages as well as a <code>rest</code> service.
  Those <code>html</code> pages call the <code>rest</code> service via <code>XMLHttpRequest</code>. The <code>rest</code> service can also be called by external application.</p>
  
  <p>On server side, in my <code>rest</code> service, I want to check if the request comes from the same domain or not because I want external application only to authenticate their request (e.g. providing an access token).</p>
  
  <p>To do so, I look at <code>req.headers.referer</code> to get the url of the page originating the request and compare with my server domain.
  Is is safe? Can <code>req.headers.referer</code> be altered by an external app trying to call my service without authentication?</p>
  
  <p>Is there a smarter / safer way to do so?</p>