Allowed Origins (Origin Allowlist)
Allowed origins are a configured list of website domains permitted to call an API from a browser. The server or gateway checks the Origin header of each request and only returns CORS permission headers, or accepts the request, when the origin is on the allowlist.
Technical Architecture & Deep-Dive
Browsers attach an Origin header to cross-site requests. By validating it, an edge gateway ensures a client token embedded in `https://myapp.com` cannot be reused by a different website.
Origin checks are a strong browser-side control but not a complete defense, because non-browser clients can forge headers. Combine allowlists with rate limiting, scoped tokens, and bot protection for layered security.
Key Architectural Benefits
Implement Allowed Origins (Origin Allowlist) at the Edge
Deploy lightweight API aggregation, edge caching, and secret injection in minutes without Docker containers or complex servers.
Frequently Asked Questions
Q:Can attackers spoof the Origin header?
Browsers do not allow scripts to change it, but scripts and servers outside a browser can. Treat origin checks as one layer, not the only one.
Related Architecture Concepts
Cross-Origin Resource Sharing (CORS) is a browser security protocol that restricts web applications from making API requests to a different domain unless the server explicitly grants permission via HTTP headers. Edge proxies resolve CORS errors by terminating browser preflight OPTIONS requests directly at the edge.
A Client Token is a scoped, revocable authentication credential designed for frontend web and mobile applications. It grants permission to invoke specific edge API pipelines while enforcing allowed-origin domains and rate limits, safely abstracting sensitive upstream API secrets.
Content Security Policy (CSP) is an HTTP response header that tells browsers which sources of scripts, styles, images, and network connections a page is allowed to use. By blocking unapproved sources, CSP reduces the impact of cross-site scripting and data exfiltration.
Ready-to-Use Edge Recipes
Webflow is a purely static and frontend visual builder with no backend server. To call private APIs from Webflow custom code without revealing secrets in the browser inspector, route requests through RealComposer. RealComposer stores your API keys in an AES-256-GCM vault, injects credentials at the edge, and handles CORS headers automatically.
To solve fix cors error in webflow api call, never execute unauthenticated requests or embed private tokens directly in client bundles. RealComposer acts as a sub-10ms edge gateway running on Cloudflare Workers that securely injects credentials from your Secret Vault, normalizes responses, and prevents unauthorized API usage. Route calls through your RealComposer edge URL to guarantee complete privacy, robust origin validation, and low mobile latency.