Origins and security

Exact-origin allowlistCopy Anchor Link

Each account can approve five origins total. Valid examples:

https://example.com
https://app.example.com
https://app.example.com:8443
http://localhost:3000
http://127.0.0.1:3001

Invalid examples:

http://example.com          # production HTTP
https://*.example.com       # wildcard
https://example.com/path    # path included
https://user@example.com    # credentials included
null                        # opaque origin

Subdomains and ports are different origins. Approving https://example.com does not approve https://app.example.com or https://example.com:8443.

What the check protectsCopy Anchor Link

Cross-origin requests require Origin, which the route validates before counting usage. The configured Blobz deployment is trusted automatically for same-origin requests from its API playground. Every successful response returns the resolved origin in Access-Control-Allow-Origin. This blocks ordinary browser pages on other origins from embedding the image successfully.

What it does not protectCopy Anchor Link

Origin is a browser control, not a secret credential. A non-browser HTTP client can send any Origin value and consume an account's allowance if it knows the public endpoint URL.

• Treat the endpoint ID as public.
• Do not use the endpoint for authorization or private images.
• Rotate or revoke an endpoint through operator support if it is abused.
• Use short-lived server-signed URLs in a different architecture if strong caller authentication is required.

Referer is intentionally not used as authentication because browsers and site policies may omit it.

Seed privacyCopy Anchor Link

The name is part of the URL and can appear in browser history, analytics, proxies, CDN logs, server logs, and copied markup. Do not place private email addresses or sensitive identifiers there unless that exposure is acceptable. An opaque stable user ID produces the same deterministic behavior with less personal data in URLs.

CachingCopy Anchor Link

Successful images currently return Cache-Control: no-store. Every served network request reaches the quota transaction. Browser or service-worker behavior outside that contract should not be relied on to reduce usage.