= Origin allowlist
:nav-title: Origin Allowlist
:description: Only the websites you list may call your service from a browser. A request from any other Origin is refused, so other sites cannot use your users' sessions.
:keywords: CORS, origin allowlist, CSRF protection, restrict API to my domain, browser security
:group: Build
:order: 40

A browser tells your service which site a request comes from, in the `Origin` header. With the allowlist on, a request from a site that is not on the list is refused with `403`. That stops another website from making your users' browsers call your API with their sessions.

Requests without an `Origin` header, from a server, a script or a mobile app, are not affected.

image::/assets/docs-images/origin-allowlist.png[The Origin Allowlist page: the plugin, and the list of allowed origins]

== Set it up

. Open **Origin Allowlist** and click **Enable**.
. Type each origin your app is served from and press Enter: `https://app.example.com`, `https://admin.example.com`, and `http://localhost:4200` while you develop. An origin is protocol, host and port; no path, no trailing slash.
. **Save**. It takes up to a minute to reach every node.

With the plugin on and the list empty, every browser request is refused. Add the origins first.

**Disable** turns the check off and keeps the list. **Uninstall** removes both.

== Before going live

Remove the `localhost` entries, and test once from each listed origin and once from one that is not.

== Related pages

* xref:managing-permissions.adoc[Permissions]: who may do what, once the request is accepted.
* xref:guards.adoc[Guards]: rules about the user's state, rather than about the site.