title: Ways to allows requests to APIs only from internal in PHP
body: <p>I know CURL &amp; HTTP authentication to allow API calls only from certain requests.</p>
  <p>I have something like this</p>
  <pre><code>www.mysite.com/list
  
  www.mysite.com/api
  </code></pre>
  <p><code>list</code> page calls the <code>api</code> page using jQuery Ajax post request and <code>api</code> page echos jSON response.</p>
  <p>I am already checking HTTP referrer to verify Post requests come from certain origins but these requests can be forged.</p>
  <p>I cannot use $_SERVER['remote_addr'] as this will check the client ip not the source ip of the API request.</p>
  <p>As both the pages are hosted in the same web server and in the same hostname, its not possible to restrict based on hostname or IP address.</p>
  <pre><code>I am aware of some alternatives like
  
  cURL with HTTP Authentication.
  </code></pre>
  <p>Encryption of jSON response and Decrypting before printing.</p>
  <p>But is there any way to restrict these API pages to securely block access from outside the server or hostname?</p>