Web API - Blocking server-specific calls

Question

Well I have the following doubt, after implementing the CORS in an application, I saw that there is still a security breach that is, if an application(Postman, Curl) make direct calls on the server they will still be answered.

I would like to know how to block calls that are not from the Url’s allowed directly on the server. Or you can implement some other direct validation in oauth to block accesses other than those Urls?

Answer 1

Then I managed to block the application in another way, through I.P. Through some researches I saw that this was the best solution to apply in the system, which is a Owin system.

Solution:

Follows the solution:

 public static string GetIP(this HttpRequestMessage request)
        {
            if (request.Properties.ContainsKey("MS_OwinContext"))
            {
                return HttpContext.Current != null ? HttpContext.Current.Request.GetOwinContext().Request.RemoteIpAddress : null;
            }
            if (request.Properties.ContainsKey("MS_HttpContext"))
            {
                return HttpContext.Current != null ? HttpContext.Current.Request.UserHostAddress : null;
            }
            return null;
        }

    public static bool AllowIP(this HttpRequestMessage request)
    {
        string whiteList= ConfigurationManager.AppSettings["whiteListIp"];
        if (!IsNullOrEmpty(whiteList))
        {
            string[] ipList = whiteList.Split(';');
            var ipAdress= request.GetIP();
            bool ipAllowed = ipList.Where(x => x.Trim().Equals(ipAdress, StringComparison.InvariantCultureIgnoreCase)).Any();
            return ipAllowed;
        }
        else return true;
    }

Filter:

    public class AllowedIpFilter: DelegatingHandler
        {
            protected override async Task<HttpResponseMessage> SendAsync(HttpRequestMessage request, 
CancellationToken cancellationToken)
            {
                if (request.AllowIP())
                {
                    return await base.SendAsync(request, cancellationToken);
                }
                return request.CreateErrorResponse(HttpStatusCode.Unauthorized, "Access denied!");
        }
    }