Stop Malicious POST requests
<p>I have an AJAX function that makes call to a page on my website.</p>

<pre><code>$(document).on('click', thisIdentity, function() {
    var trigger = $(this);
    var items = trigger.attr('data-values').split('_');
    $.ajax({
        type: "POST",
        url: "/mod/mypage.php",
        data : { pid : item[0], uid : item[1] },
        dataType: "json",
        success: function(data) {
           if(data.job == 1) {
              // do something
           }
        }
    });
});
</code></pre>

<p>Now this works fine and do as intended. However, if I use any third-party app like <strong>POSTMAN</strong> and make a <strong>POST</strong> request to <strong>www.xyz.com/mod/mypage.php</strong> with parameters <strong>pid : 1 and uid : 2</strong>. It still goes through and make changes to my database. </p>

<blockquote>
  <p>Is there anyway to check that request is generated from my
  domain/server only?</p>
  
  <p>How to stop such POST requests outside from my domain?</p>
</blockquote>

<p>One thing I thought was to generate a token and set in SESSION before this request and check in mypage.php that if token is set or not. Is this a feasible way?</p>