I'm building a SPA with a REST backend, and I don't think there's anyway around this. It seems fundamentally if you are exposing your API over HTTP, then it wi

I'm building a SPA with a REST backend, and I don't think there's anyway around this. It seems fundamentally if you are exposing your API over HTTP, then it will be accessible. All of my API actions are behind an authentication and authorization layer, but they are still unavoidably accessible once a user has authenticated. Similarly I can write a standalone client that logs in to Facebook and then do whatever I want with the data returned to me over HTTP.