Is there a way to ensure that an HTTP request to my REST server is coming from my application? I'm guessing no because whatever I do on the client side, as people have access to that code, they can figure out what I'm doing, and do the same.
Is it a valid approach to always use HTTPS (to stop prying eyes) and then require that any request includes a password we provide to each valid user? Or does that not work well in practice?
Or is there anything else we can do? We're not worried about encrypting or signing the data in the request, just verifying that it is coming from who claims they are sending it.
In our case, it is always a POST that sends us a query in an XML document so we can easily add an attribute to the XML.