title: How can I restrict access to an RESTful API with a nginx reverse proxy server?
body: <p>I have a webpage that would be served to a client, after which when they press  on the page, it will send the request to an nginx reverse proxy, which would send it along to the correct RESTful API. The nginx and RESTful APIs are on another server.</p>
  
  <p>How can I use ngnix to restrict only to the webpage, so that users cannot go directly to the API.</p>
  
  <p>I've already set CORS but I was told that CORS can be bypassed (an example is Postman).</p>
  
  <p>I have tried using (all on nginx config):</p>
  
  <pre><code>if ($host != domain.of.webpage) {
      return 444;
  }
  </code></pre>
  
  <p>Another method:</p>
  
  <pre><code>server {
      listen 443 default_server;
      listen [::]:443 default_server;
      server_name _;
      return 444;
  }
  </code></pre>
  
  <p>And another:</p>
  
  <pre><code>satisfy any;
  
  allow xx.xx.xx.xx/xx;
  allow xxxx:xxxx:xxxx:xxxx:xxxx/xx;
  deny all;
  </code></pre>
  
  <p>All restricted access but also to the webpage itself. I know the last method wouldn't work as the client that accesses it will not be on the host so the IP addresses are moot.</p>
  
  <p>Anything else I can try?</p>