mirror of
https://github.com/imputnet/cobalt.git
synced 2026-05-21 14:00:26 -05:00
Restricted domains per API keys #699
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/cobalt#699
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @benbaja on GitHub (Jan 28, 2025).
describe the feature you'd like to see
Hey there,
I would love to have the possibility to restrict certain API keys to a domain or a list of domains, as it is possible with ip adresses at the moment, for example to manage different webapps using the same cobalt instance as the backend and avoid having the API key intercepted and used by other parties.
I'm not extremely familiar with CORS but I would be down to give it a shot and open a merge request if this feature is possible and/or interesting to other people.
Kudos for the hard work! 🥇
additional context
No response
@dumbmoron commented on GitHub (Jan 29, 2025):
this is not possible because someone can just impersonate any headers that would imply it's coming from a particular domain