You can query an Opensolr index directly from browser JavaScript, but not from any origin you like. Authenticated AJAX requests are allowed only from domains we have whitelisted for your index.
01 · Why whitelisting is required
It keeps your data off other people sites
Restricting the allowed origins is what stops a third-party page from issuing authenticated requests against your index in your visitors browsers.
It shrinks the attack surface
Only approved domains can talk to the index over AJAX, which blocks drive-by and cross-site request patterns.
It is what reviewers ask for
Enterprise and public-sector security reviews routinely require origin controls on any API or cloud service.
02 · How to request access
Ask through the contact form
Use the Opensolr contact form, or write to support@opensolr.com.
List the exact origins
Scheme and host, as the browser sends them, for example https://yourapp.com and https://admin.partner.com. One line each.
Name the index or cluster
Whitelisting is applied per index, not per account.
Include your account email
The address your Opensolr account is registered with, so we can match the request to the right account.
03 · What happens next
Your origins are allowed
Once configured, authenticated AJAX requests from those domains work normally.
Everything else is refused
Requests from any other origin are blocked by default. That is the point of the mechanism.
The list can change any time
New domain, staging environment, one removed: send another request and we update it.