title: How should *intranet* REST API calls be secured?
body: <p>Here's the scenario. A user outside the firewall takes a UI action in the browser. The browser makes a REST API call to system A (and is authenticated and authorized at or near the point of entry past the firewall). System A (inside the corporate network firewall) makes a REST API call to system B (also inside the corporate network firewall).</p>
  
  <p>How much security is sufficient for the "internal" REST API call from system A to system B, considering that authentication and authorization already occurred at the entry point to system A?</p>