I have a .NET Web Api servicing a Cordova based mobile app and web front end written in AngularJS. I have done a ton of research and most sources don't give a great answer or one that's huge overkill for my situation. Security is not a huge concern but I want to employ some amount of basic security to ensure that only my app is making calls to my server.
All users are required to login through Facebook and do not have their own passwords for my app. My thought was, as long as they are auth'd through Facebook and the request is originating from my app, then they are good to go.
1) How can I secure server to ensure pre-login calls are originating from my app?