Skip to main content

Security

Two things decide whether a WF-Algolia site is safe: which key you publish, and what happens to record content on its way into the page. The script handles the second. The first is on you.

Keys

Everything in a script tag is public. View source is enough.

KeySafe in a script tagCan do
Search-OnlyYesQuery indices
AdminNeverAdd, overwrite and delete records and indices

Use a Search-Only key with the search ACL and nothing more. If an Admin key has ever been pasted into custom code, treat it as compromised and rotate it in the Algolia dashboard — republishing the site does not undo it having been public.

For the same reason, WF-Algolia's own sync stores your Admin key server-side and never sends it to the browser.

Rendering untrusted content

Anything in your index is untrusted as far as the script is concerned — CMS content passes through editors, imports and APIs, and any of those can carry markup.

Plain text bindings

wf-algolia-text writes through textContent. Markup in the field is displayed as characters, never parsed. This is the default and the safe one.

HTML bindings

wf-algolia-html exists for fields that legitimately contain rich text. It is sanitized before insertion, using the browser's own parser plus a strict allow-list.

Only these tags survive:

p · br · em · strong · b · i · u · mark · ul · ol · li · h1 · h2 · h3 · h4 · blockquote · code · pre · a · img

Any other element is unwrapped: the tag is dropped and its text is kept. A <script> in a field becomes its own text content, not an executing script.

Attributes work the same way — an allow-list, not a blocklist:

TagAttributes kept
ahref, title, target, rel
imgsrc, alt, title, width, height
everything elsenone

This is why onclick, onerror and style cannot get through. They are not blocked by name — they are simply not on the list, so nothing has to anticipate the next event-handler attribute someone invents.

URLs

Every URL-bearing attribute — a href, img src — is additionally checked. A value starting with javascript:, data: or vbscript: (case-insensitively, after trimming) is replaced with # and logged:

[wf-algolia] Blocked unsafe URL: javascript:alert(1)

Seeing that warning means a record in your index contains an attack payload, not that your markup is wrong. It is worth finding out how it got there.

Content Security Policy

If your site sets a CSP, the script needs:

  • script-srchttps://cdn.jsdelivr.net
  • connect-srchttps://*.algolia.net and https://*.algolianet.com

Add Insights to connect-src as well if you have enabled it.

Privacy

Insights tracking is off unless you set data-insights="true".

When on, it is cookieless by default — the user token lives only for the page session. Setting data-insights-cookie="true" persists it across visits, which is what makes personalization work and what may put it in scope for your cookie consent flow.

Reporting a vulnerability

Please report security issues privately rather than in a public issue.