title: How to make sure that only a specific domain can query from your REST api?
body: <p>I have an app that has a REST api. I want it so that the only requests that can be made to the REST api are ones originating from the app itself. How can I do that?
  I am using a node.js+express server too. </p>
  
  <p>EDIT: the app is fully a public web app.</p>