how to check in the htaccess file that only the service worker.js can access the secret.json file?
the host or ip address filtering is not good
I’m looking for a solution that only allows the service worker to read the file

.htaccess file

Options All -Indexes
ServerSignature Off

SetEnvIf Referer ".example.com" localreferer

<FilesMatch ".json$">
    Require all denied
    Require env localreferer
</FilesMatch>

secret.json

{
'name': 'test'
}

service worker.js

        await fetch('https://example.com/secret.json', {
          }).then(response => {
            return response.json();
          })
          .then(data => {
            console.log(data);
          })
          .catch(error => {
            console.log(error);
          });