title: How to secure all api calls in an Angular / .NET Core 2.0 application regardless of user login
body: <p>I've gone through the excellent tutorial here <a href="https://fullstackmark.com/post/13/jwt-authentication-with-aspnet-core-2-web-api-angular-5-net-core-identity-and-facebook-login" rel="nofollow noreferrer">https://fullstackmark.com/post/13/jwt-authentication-with-aspnet-core-2-web-api-angular-5-net-core-identity-and-facebook-login</a> to set up an Angular 5 web site with .net core 2.0 which issues JWT tokens to use to authenticate API requests.</p>
  
  <p>Everything works well, a user logs in, and is then given a token which is sent as an authorization header for each API request.</p>
  
  <p>My question though, is how do I secure ALL the api requests in my site, regardless of whether the user has logged in or not?</p>
  
  <p>If I have a request such as /api/articles which gets all articles, I'd like anonymous visitors to the site to be able to access it through the Angular front end, but I don't want people just hitting the API and getting the data that way.</p>