Options to harden access to anonymous APIs

Question

I need some advice on how to secure or harden access to anonymous REST APIs. The APIs will be accessed by a browser-based web application. This web application has no requirement for user authentication and so OAuth tokens is not an option I suppose. The intent is to protect these APIs from being used by unknown applications/sources.

Answer 1

Impossible.

You need some kind of secret to be shared between the client and the server (session cookie, jwt token, api token, ...) to make sure no third party is using your api.

If you don't have that, you are left with whitelisting IP addresses (usually does not work) or evaluating the origin header (I can easily bypass it with curl). On the other hand checking origin might be better than nothing, just remember, this is not bullet proof.