Add how-to on restricting rpc apis by URL

[ziad-saab]

closes MetaMask/MetaMask-planning#1285.

[github-actions]

Preview published: zs/restrict-rpc

[Montoya]

I think the tutorial should use the URL library like so: https://codepen.io/m0nt0y4/pen/WNLxYGw

Relying on Array.prototype.includes() will miss if the origin is "https://metamask.io" and the array contains "https://metamask.io/" or if the origin is "https://metamask.io/dapp/" and the array contains "https://metamask.io". The point of using the URL library is to extract the most important parts of the origin (protocol + host) and key based on that. Then you can just store the host in the array and compare against that, and require the request to always come from https. Or store both protocol + host in the array and compare against both.

I admit this can cause issues if the request is coming from a host like vercel. The truth is there's no easy way to key based on a URL, it depends on what the developer wants to use.

[Montoya]

See above

[ziad-saab]

Relying on Array.prototype.includes() will miss if the origin is "https://metamask.io" and the array contains "https://metamask.io/" or if the origin is "https://metamask.io/dapp/" and the array contains "https://metamask.io".

@Montoya it's my understanding and experience that the origin parameter is already just protocol + domain. it doesn't contain any path information. Do we still think it's necessary to include the URL manipulation in this case?

[github-actions]

Preview published: zs/restrict-rpc

[Montoya]

@ziad-saab Oh, maybe my understanding is wrong. If that is true then this approach should work fine.

[alexandratran]

Minor edits to content. LGTM.

[github-actions]

Preview published: zs/restrict-rpc