I've developed some software installed e.g. on
www.example.com. It's accessed via an HTML web page. Some HTML buttons can call PHP end points which are also on that domain. I use JWT to secure login.
But what want to do is only allow access to the end points from the office, so I'm trying to get the PHP to block any access from other domains.
but it doesn't block the end points when I try to access thehm via the
www.example.com domain web interface.
Maybe instead I have to check the client IP within the PHP and deny access if it doesn't match. But what if there's dynamic IP's and the IP's could change given enough time. Is there a way round that?
Any help appreciated.