Ulabase
Sign in

Build

Origin allowlist

Only the websites you list may call your service from a browser. A request from any other Origin is refused, so other sites cannot use your users' sessions.

With the allowlist on, your service accepts browser requests only from the sites you list. A browser sends the site a request comes from in the Origin header, and a request from a site not on the list gets 403. So another website cannot make your users' browsers call your API with their sessions.

Requests without an Origin header, from a server, a script or a mobile app, are not affected.

The Origin allowlist page: the feature

Set it up

  1. Open Origin allowlist and click Enable.

  2. Type each origin your app is served from and press Enter: https://app.example.com, https://admin.example.com, and http://localhost:4200 while you develop. An origin is protocol, host and port; no path, no trailing slash.

  3. Save. It takes up to a minute to reach every node.

With the feature on and the list empty, every browser request is refused. Add the origins first.

Disable turns the check off and keeps the list.

Before going live

Remove the localhost entries, and test once from each listed origin and once from one that is not.

Related pages

  • Permissions: who may do what, once the request is accepted.

  • Guards: rules about the user’s state.