Need help w/site specific permissions

[kukla]

(I read the sticky first) I know nothing about writing these expressions, so just following the example in 8.10 for the ABE FAQ's, I wrote the following

# livefyre.com rule
Site .livefyre.com
# the above is shortcut for livefyre.com *.livefyre.com
Accept from newyorker.com
Deny


I want to allow livefyre only on newyorker.com, but when I use this (with livefyre and nyorker.com both whitelisted) it appears to block livefyre. When I remove "Deny" it's allowed, but I have no idea if written that way it's allowing livefyre globally.

Please help me correct this.

[Giorgio Maone]

Since ABE rules and NoScript permissions are orthogonal, you also need to explicitly "Allow livefyre.com" from NoScript menu.
It will be allowed to run scripts everywhere, but it won't be able to since it's gonna be blocked by your ABE rule which prevents any livefyre.com resource from loading anywhere except from newyorker.com.

BTW, you probably want to use "Accept from .newyorker.com" (notice the leading dot).

[kukla]

Since ABE rules and NoScript permissions are orthogonal, you also need to explicitly "Allow livefyre.com" from NoScript menu.
It will be allowed to run scripts everywhere, but it won't be able to since it's gonna be blocked by your ABE rule which prevents any livefyre.com resource from loading anywhere except from newyorker.com.

BTW, you probably want to use "Accept from .newyorker.com" (notice the leading dot).

I have allowed livefyre.com and newyorker.com. But should I use Deny or not? I made the change to .newyorker.com (hadn't realized I'd left out the leading dot) and added Deny back in. Is that correct? It seems to be working there now with Deny.

This is how it stands now.

# livefyre.com rule
Site .livefyre.com
# the above is shortcut for livefyre.com *.livefyre.com
Accept from .newyorker.com
Deny

[Thrawn]

That rule should be fine (you could make it more specific if you wanted, but it's not really necessary).

Deny is usually the right choice. You might use Anon if the reason for your rule was to protect a sensitive site from cross-site request forgery, while still allowing it to provide resources to other sites. This could happen with eg Facebook, or perhaps Google.

Your current rule is saying "Requests sent to livefyre.com (or subdomains) are allowed if the origin of the request was newyorker.com (or subdomains), otherwise they are blocked". Which is probably what you want.

[kukla]

Yep, that's what I want. Thanks to you and Giorgio.