Trusted Domains

Introduction

Trusted Domains lets you restrict JavaScript SDK traffic to a defined list of domains.

Your Refiner Environment ID is included in your frontend JavaScript code and can therefore be discovered by third parties. By configuring Trusted Domains, you can prevent other websites from simply reusing your Environment ID to send JavaScript SDK traffic to your Refiner environment.

We recommend configuring Trusted Domains for production environments.

Configure Trusted Domains

Go to Settings > SDK Security > Trusted Domains and add the domains from which your Refiner JavaScript SDK is allowed to send requests.

Enter fully qualified domain names, for example:

app.myapp.com

You can also use a wildcard to allow all subdomains:

*.myapp.com

Leave the list empty if you want to accept JavaScript SDK traffic from any domain.

Security considerations

Trusted Domains provides a useful barrier against unauthorized use of your Environment ID, but it should not be considered a complete security mechanism.

Domain checks rely on information included with incoming browser requests. While this prevents straightforward misuse from other websites, a determined attacker can still construct requests manually and spoof or manipulate request metadata.

Trusted Domains should therefore be considered an additional layer of protection rather than a way to authenticate individual users.

For applications where users are identified, we also recommend enabling Identity Verification. Identity Verification cryptographically verifies individual users and provides stronger protection against user impersonation and bogus user profiles.