Origin allowlist

An origin allowlist is an explicit list of web origins - scheme plus domain plus port, like https://example.com - that are permitted to send browser-based requests to an endpoint. Everything not on the list is refused. It is the deny-by-default posture applied to the question "which websites may talk to this URL from JavaScript?"

The threat it addresses is endpoint borrowing. A public form endpoint's URL is visible in your page source; anyone can copy it into their own site and route their traffic - or their spam - through your form. An allowlist enforced through CORS shuts that down for browser traffic: the browser itself checks the endpoint's response headers, sees that the copying site's origin is not approved, and refuses to complete the request.

Its limits are worth stating plainly. CORS is a browser mechanism, so an allowlist does not constrain a curl script or server-side code, and plain HTML form posts bypass it as well. That makes an origin allowlist a precise tool rather than a perimeter - it eliminates one specific abuse channel cheaply, and belongs in a stack next to rate limits and content-level defenses that cover the channels it cannot.

SheetLink Forms provides a per-form origin allowlist. Add the domains your form legitimately lives on, and AJAX submissions from those origins proceed while requests from unlisted origins are refused with a 403; leave it unconfigured and the endpoint accepts browser traffic from anywhere. The allowlist sits in the layered stack alongside per-form and per-IP rate limits, the honeypot, content heuristics, and optional Cloudflare Turnstile.

Configuration details are in the developer docs, and the allowlist's place in the defense model on the security page.