Is it possible for someone to modify the JQuery code of a remote page and make it call the remote APIs in a different way than intended?
Suppose the website www.domain.com has a jquery.js script which calls an API always on domain.com passing a name and a surname:
now is it possible for someone to modify the jQuery from the browser with something like Firebug and call the API without name and surname for instance and thus get a whole list of people without filtering:
I could of course check in my API for the two parameters to be present but suppose I have no way of modifying the listening API program.
Could my jQuery script check for the domain from which the script is executed? for instance if someone saved my jQuery file locally and executed it, would it look to the remote API the same as if the jQuery was executed from the intended web page at www.domain.com?
My idea is that a jquery script is always run "locally" whether it is downloaded from the intended page or from a modified version, however some sites seem to be able to let an API be called only from the intended script.