IIS How to block http request from browser

Question

In Windows domain, Sliver-light out-of-browser app(used by many user) consuming a couple of WCF services hosted on IIS. Now users know WCF service endpoints, they might able to execute methods without Sliver-light App. So is that possible IIS can identify http request from browser or Sliver-light out-of-browser App then block all requests from browser but only allow http request from Sliver-light app?add IP Security on IIS not an option as that will block user use Sliver-light app, and add PrincipalPermission attribute on WCF not an option as well because need too many domain user group and WCF methos need to handle.

Answer 1

The problem resolved by implement Url re-write module in IIS. just use this module add a rule which only allow http request header HTTP-REFERER field include sliver-light .xap file. REFERER in header always has same value which is .xap file.