search

segmentio / analytics-next

Segment Analytics.js 2.0
https://segment.com/docs/connections/sources/catalog/libraries/website/javascript
MIT License
384 stars 128 forks source link

How to Set a Whitelist of Domains for a Segment JavaScript source WriteKey to Prevent Misuse? #1059

Closed naviangie closed 2 months ago

naviangie commented 3 months ago

I'm concerned about the potential for the writeKey to be extracted and misused by third parties on unauthorized domains.

Is there a way to configure a whitelist of domains through any settings in the analytics service, which would only allow my writeKey to be used from specific, authorized domains I designate?

silesky commented 3 months ago

Hey @naviangie.

Sorry, segment does not support anything like that AFAIK (an origin whitelist, or some writekey-by-writekey custom CORS headers).

The best you might be able do is revoke a write key if, say, your website is being cloned via a phishing website. This might be hacky, but it would be possible use edge functions or destination filters to just drop the event based on what's included in the page URL. You can also contact support for more help on finding a bespoke solution -- they would know more about the options.

Of course, the request body can always be crafted in a deceptive way, so there's no guarantee that the origin is valid. I responded to an issue here around why the write key is 'public' FYI: https://github.com/segmentio/analytics-next/issues/1050#issuecomment-2004604183