title: Securing publicly accessible REST endpoints
body: <p>We have a REST endpoint that provides some back end services to our publicly available Web site. The web site does not require any user authentication to access its content. Anyone can access it anonymously.</p>
  
  <p>Given this scenario, we would still like to protect the back-end REST api to be somewhat secured in the sense that only users using our Web site can call it.</p>
  
  <blockquote>
    <ol>
    <li>We dont want a malicious user to run a script outside the browser bombarding it for example.</li>
    <li>We dont even want him to run a script automating the UI to access the endpoint.</li>
    </ol>
  </blockquote>
  
  <p>I understand that a fully public endpoint without user authentication is somewhat impossible to secure. But can we restrict usage to valid scenarios?
  Some ideas:</p>
  
  <blockquote>
    <ol>
    <li>Use TLS/SSL for the communication - this protects the channel only.</li>
    <li>Use some Api key (that periodically expires) that the client/browser needs to pass to the server. (a malicious user can still use the key)</li>
    <li>Use the key to throttle the number of requests.</li>
    <li>Use it with conjunction of a CSRF token??  </li>
    <li>Use CAPTCHA on the web site to ensure human user ( adds an element of annoyance to the final user).</li>
    <li>Use IP whitelisting.</li>
    <li>Use load balancing and scaling of server to handle loads.</li>
    </ol>
  </blockquote>
  
  <p>I suppose this should be a scenario occurring in the wild.</p>
  
  <blockquote>
    <ol>
    <li>What security steps are prevalent?</li>
    <li>Is it possible to restrict usage via only the website and not via a script?</li>
    <li>If its not possible to secure, what kind of mitigations are used with such public rest endpoints?</li>
    </ol>
  </blockquote>