How to secure js api?

Question

JavaScript

There are several independent sites that receive content through an ajax request (after page loading or user action) to the provider server.

There is some way to protect yourself from connections from other sites or directly. If in php, then it’s clear that everything happens on the server and the user cannot spy on the data.

The only thing that came to my mind was to use Ajax to first contact the localhost, and from there the script to the remote server, but this complicates the logic.

But what about pure js, are there any verification options?

Answer 1

CSRF tokens that are generated on the "provider server". When a page is requested by a client, claim the token and attach it to the response to the client. AJAX requests are made using this token.

Answer 2

https://en.wikipedia.org/wiki/Cross-origin_resource...
not 100%, but still protection