title: How to accept requests only from the client
body: <p>I'm doing my own project. A simple game on <code>VueJS</code>. And it has registration on <code>JWT</code>. When the user wins/loses, the client sends a corresponding request to the backend to increase the number of wins/defeat in the database.</p>
  <p>Making endpoints for this, I realized that I can restrict access to my API to other resources using <code>CORS</code> <strong>BUT</strong> After all, the user can get his <code>jwt access token</code> from the <code>localStorage</code> or view it in other requests in the network tab. And looking in the same tab, what the request sent when winning looks like, send the same request from the browser console using <code>fetch</code> with the token he received earlier. This way he will be able to increase the number of wins without playing the game. And <code>CORS</code> will not block this request in any way, because the header <code>Origin</code> will be the same.</p>
  <p>And so the question is: <strong>how can my API accept requests only sent by my game (<code>axios</code>)</strong></p>