Hi everybody

Can anybody tell me how exactly domain restriction is enforced when setting something like a messenger deployment to only be accessible from certain domains?  Does it look for something in the headers or something else more intelligent?

Hi Vaun - backend check happens based on Origin header from incoming HTTP request.

Hi everybody

Can anybody tell me how exactly domain restriction is enforced when setting something like a messenger deployment to only be accessible from certain domains?  Does it look for something in the headers or something else more intelligent?

Thanks Angelo, so someone could theoretically spoof that header to bypass the domain restriction?

Hi Vaun - backend check happens based on Origin header from incoming HTTP request.

Hi everybody

Can anybody tell me how exactly domain restriction is enforced when setting something like a messenger deployment to only be accessible from certain domains?  Does it look for something in the headers or something else more intelligent?

Browsers do not allow JavaScript to manipulate or tamper with that header, access is forbidden.

Thanks Angelo, so someone could theoretically spoof that header to bypass the domain restriction?

Hi Vaun - backend check happens based on Origin header from incoming HTTP request.

Hi everybody

Can anybody tell me how exactly domain restriction is enforced when setting something like a messenger deployment to only be accessible from certain domains?  Does it look for something in the headers or something else more intelligent?