Mini Program permission control

Control which resources a Mini Program can access by configuring its whitelists in the mPaaS console. When the permission control switch is on, the miniapp can only access resources and call APIs that are explicitly added to the whitelist.

Three whitelist types are available:

• Server domain name whitelist: Restricts the server domains that the miniapp can reach in my.request calls. Only HTTPS domains are supported, and you can add up to 30 domain names.

• API whitelist: Restricts which APIs the miniapp can call. Any API not on the whitelist is blocked when access control is enabled.

  Note

  APIs provided on the official mPaaS website are already included in the permission file by default and do not require manual configuration. Only add your custom APIs.

• Built-in WebView domain name whitelist: Restricts the URLs that the web-view component can load. Only HTTPS domains are supported.

Prerequisites

Before you begin, ensure that you have:

• A miniapp created in Miniapp Package Management

Select a miniapp

At the top of the page, select an existing miniapp from the drop-down list. The name and AppId of the miniapp are displayed below your selection.

Permission control switch

Use the permission control switch to enable or disable the Server domain name whitelist, API whitelist, and Built-in WebView domain name whitelist for the selected miniapp.

Server domain name whitelist

The server domain name whitelist controls which server domains the miniapp can reach when making network requests.

Add a server domain name

1. Log in to the mPaaS console and select an application. In the left navigation bar, select Mini Program > Release Mini Program.

2. Select the Manage open platform Mini Program tab, then click Add in the Server domain name whitelist tab.

3. In the Add server domain name whitelist dialog box, enter the following information:

   • Domain name: Required. Enter an HTTPS domain name. Non-HTTPS domain names are blocked at call time.

   • Remark: Optional. Enter a description for this domain name, up to 200 characters.

4. Click OK.

Edit or delete a server domain name

To edit a server domain name, click Edit in the Operation column and update the domain name or its description.

To delete a server domain name, click Delete in the Operation column, then click OK in the confirmation dialog box.

API whitelist

The API whitelist controls which APIs the miniapp can call.

Add an API

1. Log in to the mPaaS console and select an application. In the left navigation bar, select Mini Program > Release Mini Program.

2. Select the Manage open platform Mini Program tab, then click Add in the API whitelist tab.

3. In the Add Mini Program API Whitelist dialog box, enter the following information:

   • API: The API to add to the whitelist.

   • Remark: Optional. Enter a description for this API, up to 200 characters.

4. Click OK.

Edit or delete an API

To edit an API, click Edit in the Operation column and update the API or its description.

To delete an API, click Delete in the Operation column, then click OK in the confirmation dialog box.

Built-in WebView domain name whitelist

The built-in WebView domain name whitelist controls which URLs the embedded WebView component can load.

Add a built-in WebView domain name

1. Log in to the mPaaS console and select an application. In the left navigation bar, select Mini Program > Release Mini Program.

2. Select the Manage open platform Mini Program tab, then click Add in the Built-in WebView domain name whitelist tab.

3. In the Add WebView domain name whitelist dialog box, enter the following information:

   • Domain name: Required. Enter an HTTPS domain name. Non-HTTPS domain names are blocked at call time.

   • Remark: Optional. Enter a description for this domain name, up to 200 characters.

4. Click OK.

Edit or delete a built-in WebView domain name

To edit a WebView domain name, click Edit in the Operation column and update the domain name or its description.

To delete a WebView domain name, click Delete in the Operation column, then click OK in the confirmation dialog box.