title: mvc web api only allow requests from same server
body: <p>I am building an mvc application and I am making an api controller to allow ajax requests from some of my front end pages. I want to restrict the api controller actions to only allow requests from my server (so people can not call my api from their own sites).</p>
  
  <p>After some searching around, I found numerous solutions proposing a custom authorize attribute, which I made:</p>
  
  <pre><code>public class LocalRequestOnlyAttribute : AuthorizeAttribute
      {
       protected override bool AuthorizeCore(HttpContextBase context)
              {
                  return context.Request.IsLocal;
              }
  }
  </code></pre>
  
  <p>and then dropped it on my controller action with <code>[LocalRequestOnly]</code></p>
  
  <p>it works fine on localhost, but on my aws server, it does not work, the ajax request comes back as an error</p>
  
  <p>EDIT - Details:</p>
  
  <p>I am using the hostname with a relative path. so my url for the ajax call is "/api/getdata". 
  I am not setting any ajax request headers.
  The error I am getting back is <code>No 'Access-Control-Allow-Origin' header is present on the requested resource.</code></p>