Security and connected sites

Connected sites

In the panel, under Website integration, the business adds the sites where it shows booking and content. The panel gives ready code for each site.

• Reading is public. Published content and portfolio are public data.
• Booking from a site that is not connected is refused with 403 ORIGIN_NOT_ALLOWED. This prevents unwanted embedding but is not access control.
• The booking frame checks the site it is opened on before starting (embed-check). It does not run on a site that is not connected. The link always works.

How to enter a domain

Enter	Do not enter
https://yourbusiness.com	yourbusiness.com (without https://)
https://www.yourbusiness.com	https://yourbusiness.com/book (with a path)
https://book.yourbusiness.com	https://yourbusiness.com/ (with a trailing slash)

To a browser, addresses with and without www are two different sites. If your site works on both, add both.

Every address must start with https://. The only exception is testing on your own computer: http://localhost:port and http://127.0.0.1:port are allowed, for example http://localhost:4321. Remove them when the site goes live.

CORS

• Applies to public/v1/* and api/*, without cookies or login.
• The panel, the booking page and the business’s connected sites are allowed.
• Allowed request headers: Accept, Content-Type, Authorization, If-None-Match.
• Exposed response headers: ETag, Date, Age, X-Source-Validated-At, X-Public-Cache.

Content Security Policy on your site

If your site uses CSP, allow:

script-src  https://zakazi.tempact.app
style-src   https://zakazi.tempact.app
frame-src   https://zakazi.tempact.app
connect-src https://app.tempact.app
img-src     https://app.tempact.app

Server headers

HSTS for one year including subdomains, X-Content-Type-Options: nosniff, Referrer-Policy: strict-origin-when-cross-origin and no Server header.

Images in sections

Only https: URLs or the system’s own addresses (/public/v1/media/) are accepted.