# How to Restrict Enterprise Search to a specific Domain Origin **URL:** \ **Category:** Elastic Search\ **Created:** [March 2, 2021, 7:01am UTC](https://discuss.elastic.co/t/how-to-restrict-enterprise-search-to-a-specific-domain-origin/265907 "2021-03-02T07:01:13Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![MCL](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mcl/32/82953_2.png) [@MCL](https://discuss.elastic.co/u/MCL)\ **Post date:** [March 2, 2021, 7:01am UTC](https://discuss.elastic.co/t/how-to-restrict-enterprise-search-to-a-specific-domain-origin/265907/1 "2021-03-02T07:01:13Z")
Hi, We just set up enterprise search for our website. We use the query suggestion api (/api/as/v1/engines/{ENGINE\_NAME}/query\_suggestion) on our frontend. Since our endpoint and public key are exposed, how can we restrict so that the api only allows requests from our domain? I tried to set up CORS by adding these two lines to elasticsearch.yml ```auto http.cors.enabled: true http.cors.allow-origin: https://www.domain.com ``` But it doesn't seem to work. I can still access the api from another domain. What's the right way to restrict the origin? Thanks! ---
**Author:** ![Irina\_Truong](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/irina_truong/32/112040_2.png) [@Irina\_Truong](https://discuss.elastic.co/u/Irina_Truong)\ **Post date:** [March 2, 2021, 7:01pm UTC](https://discuss.elastic.co/t/how-to-restrict-enterprise-search-to-a-specific-domain-origin/265907/2 "2021-03-02T19:01:38Z")
Great question! I wish I had a great answer. Right now, there's no out-of-the-box support for this feature in Enterprise Search. You might be able to achieve this by proxying requests through nginx (or similar) and configuring CORS on that level. ---
**Author:** ![MCL](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mcl/32/82953_2.png) [@MCL](https://discuss.elastic.co/u/MCL)\ **Post date:** [March 3, 2021, 1:37am UTC](https://discuss.elastic.co/t/how-to-restrict-enterprise-search-to-a-specific-domain-origin/265907/3 "2021-03-03T01:37:23Z")
Great, thanks for the suggestion. Latency might be an issue but I'll have to give it a try to know ---
**Author:** ![oleksiy-elastic](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/oleksiy-elastic/32/49074_2.png) [@oleksiy-elastic](https://discuss.elastic.co/u/oleksiy-elastic)\ **Post date:** [March 3, 2021, 2:32pm UTC](https://discuss.elastic.co/t/how-to-restrict-enterprise-search-to-a-specific-domain-origin/265907/4 "2021-03-03T14:32:23Z")
Latency should not be a huge issue as long as the proxy is located near the Enterprise Search cluster. If you're running a self-managed deployment, running in the same VM or, at least, the same availability zone is recommended. For Elastic Cloud deployments, I'd recommend using the same cloud provider and the same region as your deployment. Then the extra latency should be sub-1ms. ---
**Author:** ![constancecchen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/constancecchen/32/71762_2.png) [@constancecchen](https://discuss.elastic.co/u/constancecchen)\ **Post date:** [March 3, 2021, 5:28pm UTC](https://discuss.elastic.co/t/how-to-restrict-enterprise-search-to-a-specific-domain-origin/265907/5 "2021-03-03T17:28:31Z")
I've also filed an internal enhancement request for potentially adding this Enterprise Search config option in the future. Thanks so much for the suggestion @MCL! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 4, 2022, 8:25am UTC](https://discuss.elastic.co/t/how-to-restrict-enterprise-search-to-a-specific-domain-origin/265907/6 "2022-11-04T08:25:25Z")