# Domain based restriction

**URL:** <https://www.ruby-forum.com/t/domain-based-restriction/161300>\
**Category:** Ruby\
**Created:** [February 25, 2009, 8:59am UTC](https://www.ruby-forum.com/t/domain-based-restriction/161300 "2009-02-25T08:59:59Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![brianzimmer](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/6f9a4e/32.png) [@brianzimmer](https://www.ruby-forum.com/u/brianzimmer)\
**Post date:** [February 25, 2009, 8:59am UTC](https://www.ruby-forum.com/t/domain-based-restriction/161300/1 "2009-02-25T08:59:59Z")

</div>

Hello,

I’m working on an application where I allow users to embed a uniquely  
generated block of js code which also includes an swf file on their own  
domain. I have a setup where a user enters their domain in my  
application, I generate a random key to associate with the user / domain  
and I generate a block of js code for them to copy / embed on their  
domain. I’m not sure how to “check the referring domain”…

How could I go about preventing non-authorized domains from embedding  
this code?

I guess what I’m looking for is something like “URL based restriction”.

I would like to somehow verify the domain before the js / swf file loads  
on the user’s domain. If the domain is invalid then display an error and  
do not load the code / swf.

Is it best to do this with some sort of ajax call? Is there a better  
approach? Are there any modules / plugins to assist with this  
functionality?

This seems kind of like the google maps API but unique for each user /  
domain.

Or is there a way to create a “white list” of acceptable domains that  
can embed the code? I thought about generating a unique js file for each  
user but that seems a but cumbersome / brittle. And what’s to stop  
someone from viewing the source of the js file, modifying it / removing  
the “url authentication” and using it as they please?

Any suggestions appreciated.

Thank you.

---

<div class="post-metadata">

**Author:** ![brianzimmer](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/6f9a4e/32.png) [@brianzimmer](https://www.ruby-forum.com/u/brianzimmer)\
**Post date:** [February 25, 2009, 2:07pm UTC](https://www.ruby-forum.com/t/domain-based-restriction/161300/2 "2009-02-25T14:07:52Z")

</div>

The word “Ruby” didn’t appear once in your posting - perhaps you should  
try another forum.

If you are using some Ruby-based web application framework (e.g. Rails,  
Merb, Sinatra etc) then you could try posting in one of those forums.  
But to be honest this sounds more like a general web development  
question.