The only thing you get from a cURL call is the remote IP in the REMOTE_ADDR environment variable.

AFAIK, that is very hard to fake meaningfully (ie. when the caller wants to actually receive data.)

So if you can live with limiting the customer to an IP, you should be reasonably safe by checking that variable.

However, of course, that gives you no control over which domain they use the data for. That's not reasonably possible - an IP can be used for multiple domains.

You could, however, try to resolve a domain name to its IP, and compare that to the REMOTE_ADDR you are getting. 

I don't think this is a good idea overall; see my comment above.

Reliably detect caller domain over cURL request?
So I just learned about the jasager attack, via the wifi pineapple and it struck me immediately that it wouldn't work at all if network managers (privately) associated MAC addresses with hotspots and asked for explicit permission if you were going to connect to a new physical device.

Obviously this would be mildly irritating in public hotspots where devices change and hundreds of diverse locations share network names, but it would make home and work networks much harder to penetrate.

I haven't found any wifi managers that do this, or at least I haven't found information that any do.

My question: 


Am I missing something obvious? Would remembering MACs not actually increase security?
If it would, are there any network managers that do this? (I'm on Linux, but if there are tools for other OS's I think it's worth having them in the answers)

