[pmontra]

Web apps always had a chance to decide who to talk to.

This is trivial when they are clients of some other APIs, so about server side choices:

- domains, if reverse proxies / firewalls give them the IP of the client

- routes, by servicing the good URIs and 404 the bad ones (attacks more than honest mistakes)

- users, with many different authentication systems

- data, with validations.

The former points are traditionally more in the domain of the network infrastructure, the latter ones are for the application. I've seen all the possible combinations in the last 30 years.