如何在asp.net web api中过滤本地请求？

Install-Package Microsoft.AspNet.WebApi.Cors

using System.Web.Http;
using System.Web.Http.Cors;

public static class WebApiConfig
{
    public static void Register(HttpConfiguration config)
    {
        var cors = new EnableCorsAttribute("http://localhost:5000", "*", "*");
        config.EnableCors(cors);

        // 其他配置代码
    }
}

using System.Net.Http;
using System.Web.Http.Filters;

public class LocalRequestFilterAttribute : ActionFilterAttribute
{
    public override void OnActionExecuting(HttpActionContext actionContext)
    {
        var referer = actionContext.Request.Headers.Referer?.AbsoluteUri;
        if (referer != null && referer.StartsWith("http://localhost"))
        {
            base.OnActionExecuting(actionContext);
        }
        else
        {
            actionContext.Response = new HttpResponseMessage(System.Net.HttpStatusCode.Forbidden)
            {
                Content = new StringContent("本地请求才能访问")
            };
        }
    }
}

[LocalRequestFilter]
public class ValuesController : ApiController
{
    // 控制器代码
}

public class ValuesController : ApiController
{
    [LocalRequestFilter]
    public IHttpActionResult Get()
    {
        // 获取数据代码
    }
}

using System.Net;
using System.Net.Http;
using System.Web.Http.Filters;

public class LocalRequestFilterAttribute : ActionFilterAttribute
{
    public override void OnActionExecuting(HttpActionContext actionContext)
    {
        var ipAddress = actionContext.Request.GetRemoteAddress();
        if (IPAddress.IsLoopback(ipAddress) || IPAddress.IsLocal(ipAddress))
        {
            base.OnActionExecuting(actionContext);
        }
        else
        {
            actionContext.Response = new HttpResponseMessage(System.Net.HttpStatusCode.Forbidden)
            {
                Content = new StringContent("本地请求才能访问")
            };
        }
    }
}