I'm a newer programmer who is trying to understand web security.
Say I were to build an IP address lookup API service. I want to make sure that requests come from where they say they do. So I don't want someone to spoof example.com and make a request to my service. Is there a way to do this, without making the real example.com use server side code?