CORSSubscriber

readme.md

API protection only if you have web -> api. For mobiles and if you use CDN this approach will not work

CORSSubscriber.php

/**
 * Class self
 */
final class CORSSubscriber implements EventSubscriberInterface{
    /**
     * @return array
     */
    public static function getSubscribedEvents() : array {
        return [
            KernelEvents::REQUEST => 'checkAllowedHosts',
        ];
    }


    /**
     * @param GetResponseEvent $event
     */
    public function checkAllowedHosts(GetResponseEvent $event) : void
    {
        $request        = $event->getRequest();
        $allowedIps = [
          'dev' === getenv('APP_ENV') ? '127.0.0.1' : 'your.UI.IP',
        ];
        if (false === in_array($request->getClientIp(), $allowedIps, true)) {
            $event->setResponse(
               new JsonResponse('Error c')
            );
        }
    }
}