Add how-to on restricting rpc apis by URL

snaps/how-to/connect-to-a-snap.md

@@ -1,6 +1,6 @@
 ---
 description: Connect your dapp to existing, third-party Snaps.
-sidebar_position: 7
+sidebar_position: 8
 ---
 
 # Connect to a Snap

snaps/how-to/debug-a-snap/index.md

@@ -1,5 +1,5 @@
 ---
-sidebar_position: 5
+sidebar_position: 6
 ---
 
 # Debug a Snap

snaps/how-to/publish-a-snap.md

@@ -1,6 +1,6 @@
 ---
 description: Develop, test, and publish a Snap.
-sidebar_position: 6
+sidebar_position: 7
 ---
 
 # Publish a Snap

snaps/how-to/restrict-rpc-api.md

@@ -0,0 +1,68 @@
+---
+description: Restrict your Snap's RPC API methods.
+sidebar_label: Restrict RPC API methods
+sidebar_position: 4
+---
+
+# Restrict a Snap's RPC API methods
+
+If the `dapps` caveat of the [`endowment:rpc`](../reference/permissions.md#endowmentrpc) permission
+is set to `true`, any dapp can call the Snap's RPC API by default.
+You can [restrict the whole API](#restrict-the-whole-api) to specific dapp origins or
+[restrict the API by method and origin](#restrict-by-method-and-origin).
+
+## Restrict the whole API
+
+The `endowment:rpc` permission has an optional
+[`allowedOrigins`](../reference/permissions.md#allowed-origins) caveat.
+You can use this to restrict the domains that are allowed to make calls to the Snap's RPC API.
+
+## Restrict by method and origin
+
+Sometimes a more granular control is required, such as filtering by method _and_ caller origin.
+
+You can restrict by method and origin using the `origin` parameter of the
+[`onRpcRequest`](../reference/entry-points.md#onrpcrequest) entry point.
+For example:
+
+```typescript
+import type { OnRpcRequestHandler, UnauthorizedError } from "@metamask/snaps-sdk";
+
+type MethodPermission = "*" | string[];
+
+const RPC_PERMISSIONS: Record<string, MethodPermission> = {
+    hello: "*",
+    secureMethod: [
+        "https://metamask.io",
+        "https://www.mydomain.com"
+    ]
+};
+
+const isAllowed = (method: string, origin: string) => {
+    return RPC_PERMISSIONS[method] === "*" || RPC_PERMISSIONS[method].includes(origin);
+};
+
+export const onRpcRequest: OnRpcRequestHandler = async ({
+    origin,
+    request,
+}) => {
+    // Check permissions
+    if (!isAllowed(request.method, origin)) {
+        throw new UnauthorizedError(`Method ${request.method} not authorized for origin ${origin}.`);
+    }
+
+    switch (request.method) {
+        case "hello":
+            return "world!";
+
+        case "secureMethod":
+            return "The secret is: 42";
+
+        default:
+            throw new Error("Method not found.");
+    }
+};
+```
+
+You can construct more powerful filtering methods using regular expressions or any other logic of
+your choice.

snaps/how-to/test-a-snap.md

@@ -1,6 +1,6 @@
 ---
 description: Use Jest for end-to-end Snap testing.
-sidebar_position: 4
+sidebar_position: 5
 ---
 
 # Test a Snap

snaps/learn/best-practices/security-guidelines.md

@@ -72,7 +72,7 @@ The following are guidelines for user notifications and authorizations:
   2. Filter specific methods to specific URLs using the built-in [URL
      library](https://developer.mozilla.org/en-US/docs/Web/API/URL): 
 
-    ```JavaScript
+    ```javascript
     const referrer = new URL(origin);
 
     if(referrer.protocol === "https:" && 

snaps/reference/permissions.md

@@ -236,7 +236,9 @@ Specify this permission in the manifest file as follows:
 }
 ```
 
-Alternatively, you can specify the caveat `allowedOrigins` to restrict requests to specific domains or Snap IDs. 
+#### Allowed origins
+
+Alternatively, you can specify the caveat `allowedOrigins` to restrict all requests to specific domains or Snap IDs. 
 Calls from any other origins are rejected. 
 
 Specify this caveat in the manifest file as follows: