How to Put Domain Restrictions on Calculator

Why Restrict Domains?

Restricting domains on your calculator provides several benefits:

• Security: Prevent unauthorized access to sensitive calculations.
• Data Integrity: Ensure calculations are only performed by approved domains.
• Compliance: Meet regulatory requirements for data handling.
• Brand Protection: Prevent your calculator from being embedded on malicious sites.

Without domain restrictions, your calculator could be used in unintended ways, leading to potential security risks and compliance issues.

Methods to Restrict Domains

There are several methods to implement domain restrictions on your calculator:

1. Referrer Header Check: Verify the HTTP referrer header to ensure requests come from approved domains.
2. CORS (Cross-Origin Resource Sharing): Configure your server to only respond to requests from specific domains.
3. API Key Authentication: Require an API key that is only distributed to approved domains.
4. IP Whitelisting: Allow only requests from specific IP ranges.
5. JavaScript Domain Check: Use client-side JavaScript to verify the domain before performing calculations.

Implementation Guide

Method 1: Referrer Header Check

This method involves checking the HTTP referrer header to ensure the request comes from an approved domain.

// Get the referrer header
$referrer = $_SERVER['HTTP_REFERER'] ?? '';

// List of approved domains
$approvedDomains = ['example.com', 'trusted-site.com'];

// Check if the referrer is from an approved domain
$isApproved = false;
foreach ($approvedDomains as $domain) {
    if (strpos($referrer, $domain) !== false) {
        $isApproved = true;
        break;
    }
}

// If not approved, deny access
if (!$isApproved) {
    http_response_code(403);
    die('Access denied');
}

Method 2: CORS Configuration

Configure your server to only respond to requests from specific domains using CORS headers.

const express = require('express');
const app = express();

// List of approved domains
const approvedDomains = ['https://example.com', 'https://trusted-site.com'];

// Middleware to check CORS
app.use((req, res, next) => {
    const origin = req.headers.origin;

    if (approvedDomains.includes(origin)) {
        res.setHeader('Access-Control-Allow-Origin', origin);
    }

    next();
});

// Calculator endpoint
app.get('/calculate', (req, res) => {
    // Perform calculation
    res.json({ result: 'Calculation result' });
});

app.listen(3000, () => console.log('Server running'));

Method 3: JavaScript Domain Check

Use client-side JavaScript to verify the domain before performing calculations.

// List of approved domains
const approvedDomains = ['example.com', 'trusted-site.com'];

// Check if the current domain is approved
function isDomainApproved() {
    const currentDomain = window.location.hostname;
    return approvedDomains.includes(currentDomain);
}

// Perform calculation only if domain is approved
function performCalculation() {
    if (!isDomainApproved()) {
        alert('This calculator is not available on your domain.');
        return;
    }

    // Perform calculation
    console.log('Calculation performed');
}

Best Practices

When implementing domain restrictions, follow these best practices:

• Combine Methods: Use multiple methods for enhanced security.
• Keep Lists Updated: Regularly review and update your approved domain lists.
• Provide Clear Feedback: Inform users when access is denied.
• Test Thoroughly: Verify that your restrictions work as expected.
• Monitor Logs: Keep track of access attempts to detect potential security issues.